Copyright (c) 2003-2026 The DragonFly Project.
Copyright (c) 1992-2003 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
	The Regents of the University of California. All rights reserved.
DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
    root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC
acpi_hpet: frequency 100000000
Using cputimer HPET for TSC calibration
Timer latency (in TSC ticks): 33516 min=33224 max=33950
TSC clock: 3600009102 Hz, NOT invariant
CPU: QEMU Virtual CPU version 2.5+ (3600.01-MHz K8-class CPU)
  Origin="GenuineIntel"  Id=0x60fb1  Family=0xf  Model=0x6b  Stepping=1
  Features=0x1783fbfd<FPU,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR,SSE,SSE2,HTT>
  Features2=0x80202001<SSE3,CX16,x2APIC,VMM>
  AMD Features=0x20100800<SYSCALL,NX,LM>
  AMD Features2=0x1<LAHF>
  MONITOR/MWAIT Features=0x2<INTBRK>
VMM/Hypervisor: Origin="KVMKVMKVM"
real memory  = 4293381120 (4094 MB)
avail memory = 4088926208 (3899 MB)
LAPIC: enter X2APIC mode
madt_lapic_probe: lapic_count=6 x2apic_count=0
ACPI CPUS = 6
lapic: divisor index 0, frequency 500003162 Hz
CPU Topology: cores_per_chip: 6; threads_per_core: 1; chips_per_package: 1;
srat_probe: can't locate SRAT
SMI Frequency (worst case): 33333 Hz (30 us)
Initialize MI interrupts for 6 cpus
TSC is not invariant, no further tests will be performed
Spectre: support=( none ) req=ffff operating=( none )
MDS: support=( none ) req=ffff operating=( none )
machdep.meltdown_mitigation enabled to protect against (mostly Intel) meltdown bug
system call performance will be impacted
interrupt uses mplock: swi_taskq
wdog: In-kernel automatic watchdog reset enabled
md0: Malloc disk
evdev device loaded.
kbd1 at kbdmux0
ACPI: RSDP 0x00000000000F59A0 000014 (v00 BOCHS )
ACPI: RSDT 0x00000000BFFE1CAC 000034 (v01 BOCHS  BXPC     00000001 BXPC 00000001)
ACPI: FACP 0x00000000BFFE1B38 000074 (v01 BOCHS  BXPC     00000001 BXPC 00000001)
ACPI: DSDT 0x00000000BFFE0040 001AF8 (v01 BOCHS  BXPC     00000001 BXPC 00000001)
ACPI: FACS 0x00000000BFFE0000 000040
ACPI: APIC 0x00000000BFFE1BAC 0000A0 (v01 BOCHS  BXPC     00000001 BXPC 00000001)
ACPI: HPET 0x00000000BFFE1C4C 000038 (v01 BOCHS  BXPC     00000001 BXPC 00000001)
ACPI: WAET 0x00000000BFFE1C84 000028 (v01 BOCHS  BXPC     00000001 BXPC 00000001)
sc0: <System console> on motherboard
sc0: VGA <16 virtual consoles, flags=0x100>
acpi0: <BOCHS BXPC> on motherboard
ACPI: 1 ACPI AML tables successfully acquired and loaded
ACPI FADT: SCI testing interrupt mode ...
ACPI FADT: SCI select level/high
acpi0: Power Button (fixed)
acpi_hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
acpi_timer0 on acpi0
isab0: <ACPI Generic ISA bridge> on acpi0
isa0: <ISA bus> on isab0
cpu0: <ACPI CPU> on acpi0
cpu_cst0: <ACPI CPU C-State> on cpu0
cpu1: <ACPI CPU> on acpi0
cpu_cst1: <ACPI CPU C-State> on cpu1
cpu2: <ACPI CPU> on acpi0
cpu_cst2: <ACPI CPU C-State> on cpu2
cpu3: <ACPI CPU> on acpi0
cpu_cst3: <ACPI CPU C-State> on cpu3
cpu4: <ACPI CPU> on acpi0
cpu_cst4: <ACPI CPU C-State> on cpu4
cpu5: <ACPI CPU> on acpi0
cpu_cst5: <ACPI CPU C-State> on cpu5
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
isab1: <PCI-ISA bridge> at device 1.0 on pci0
isa1: <ISA bus> on isab1
atapci0: <Intel PIIX3 WDMA2 controller> port 0xc0a0-0xc0af,0x376,0x170-0x177,0x3f6,0x1f0-0x1f7 at device 1.1 on pci0
ata0: <ATA channel 0> on atapci0
interrupt uses mplock: ata0
ata1: <ATA channel 1> on atapci0
interrupt uses mplock: ata1
acd0: DVDROM <QEMU DVD-ROM/2.5+> at ata1-master WDMA2
pci0: <bridge> (vendor 0x8086, dev 0x7113) at device 1.3 irq 9
vgapci0: <VGA-compatible display> mem 0xfebd0000-0xfebd0fff,0xfd000000-0xfdffffff at device 2.0 on pci0
vgapci0: Boot video device
virtio_pci0: <VirtIO PCI Network adapter> port 0xc080-0xc09f mem 0xfe000000-0xfe003fff,0xfebd1000-0xfebd1fff irq 11 at device 3.0 on pci0
vtnet0: <VirtIO Networking Adapter> on virtio_pci0
virtio_pci0: host features: 0x79bf8064 <EventIdx,RingIndirect,AnyLayout,NotifyOnEmpty,SetMacAddress,GuestAnnounce,RxModeExtra,VLanFilter,RxMode,ControlVq,Status,MrgRxBuf,TxAllGSO,MacAddress,DynOffload>
virtio_pci0: negotiated features: 0x198f8020 <RingIndirect,AnyLayout,NotifyOnEmpty,SetMacAddress,VLanFilter,RxMode,ControlVq,Status,MrgRxBuf,MacAddress>
virtio_pci0: using 3 MSI-X vectors
vtnet0: MAC address: 52:54:00:12:34:56
virtio_pci1: <VirtIO PCI Block adapter> port 0xc000-0xc07f mem 0xfe004000-0xfe007fff,0xfebd2000-0xfebd2fff irq 11 at device 4.0 on pci0
vtblk0: <VirtIO Block Adapter> on virtio_pci1
virtio_pci1: host features: 0x79007e54 <EventIdx,RingIndirect,AnyLayout,NotifyOnEmpty,WriteZeroes,Discard,MultiQueue,ConfigWCE,Topology,FlushCommand,BlockSize,DiskGeometry,MaxNumSegs>
virtio_pci1: negotiated features: 0x10001a54 <RingIndirect,MultiQueue,ConfigWCE,FlushCommand,BlockSize,DiskGeometry,MaxNumSegs>
virtio_pci1: using 6 MSI-X vectors
vtblk0: Virtio: ncylinders at legacy maximum (16383), recalculating to 62415
vtblk0: Block size: 512
vtblk0: 30720MB (62914560 512 byte sectors: 16H 63S/T 16383C)
atkbdc0: <Keyboard controller (i8042)> port 0x64,0x60 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
psm0: <PS/2 Mouse> irq 12 on atkbdc0
interrupt uses mplock: psm0
psm0: model IntelliMouse Explorer, device ID 4
sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 on acpi0
sio0: type 16550A, console
ACPI: Enabled 2 GPEs in block 00 to 0F
rdrand0: No RdRand support.
orm0: <ISA Option ROM> at iomem 0xe8000-0xeffff on isa1
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa1
sio2: can't drain, serial port might not exist, disabling
hpt27xx: no controller detected.
CAM: Configuring 2 busses
CAM: finished configuring all busses
cd0 at ata1 bus 0 target 0 lun 0
cd0: <QEMU QEMU DVD-ROM 2.5+> Removable CD-ROM SCSI-0 device 
cd0: 16.000MB/s transfers
cd0: Attempt to query device size failed: NOT READY, Medium not present
Mounting root from hammer2:vbd0s1d
hammer2_mount: root devstr="vbd0s1d"
hammer2_mount: device="vbd0s1d" label="ROOT" rdonly=1
hammer2_ondisk: "/dev/vbd0s1d" zone=2 id=0 offset=0x0000000000000000 size=0x000000063f000000
hammer2_mount: hmp=0xfffff8008fae0000 pmp=0xfffff80090280000
DMA space used: 13580k, remaining available: 131072k
Mounting devfs
hammer2_mount: "vbd0s1d": no recovery needed
hammer2: enable read/write
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
swap low/high-water marks set to 41940/62910
dfrig_cyx: DF-2213 rig loaded (production chipsets/ata-cyrix.c:98 included verbatim; kernel handler addr=0x0 tbl=0x0)
dfrig_cyx: kernel .rodata piotiming[] @ 0xffffffff80d0cd20 (verified: [0..4] == source constants):
dfrig_cyx:   [ 0] @+0x00 = 0x00009172  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 1] @+0x04 = 0x00012171  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 2] @+0x08 = 0x00020080  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 3] @+0x0c = 0x00032010  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 4] @+0x10 = 0x00040010  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 5] @+0x14 = 0x00000000  OOB: pad hole
dfrig_cyx:   [ 6] @+0x18 = 0x00077771  OOB: dmatiming[0]
dfrig_cyx:   [ 7] @+0x1c = 0x00012121  OOB: dmatiming[1]
dfrig_cyx:   [ 8] @+0x20 = 0x00002020  OOB: dmatiming[2]  <-- PIO0 (0x08) lands here
dfrig_cyx:   [ 9] @+0x24 = 0x00000000  OOB: pad hole      <-- PIO1 (0x09) lands here
dfrig_cyx:   [10] @+0x28 = 0x00921250  OOB: udmatiming[0] <-- PIO2 (0x0a) lands here
dfrig_cyx:   [11] @+0x2c = 0x00911140  OOB: udmatiming[1] <-- PIO3 (0x0b) lands here
dfrig_cyx:   [12] @+0x30 = 0x00911030  OOB: udmatiming[2] <-- PIO4 (0x0c) lands here
dfrig_cyx:   [13] @+0x34 = 0x00000000  OOB: unrelated driver constant
dfrig_cyx[go1]: BEFORE dispatch: ch->dma=0xffffffff82601020 ctlr->r_res1=0xffffffff82601800 (guard ata-cyrix.c:84 passes) atadev->unit=0
dfrig_cyx[go1]: dispatching production ata_cyrix_setmode(dev, 0x0f) (RUNNING KERNEL own copy)
dfrig_cyx[go1]: RETURNED: ch->dma->alignment=16 max_iosize=32768
dfrig_cyx[go1]: requested mode=0x0f settled mode=0x0c controlcmd_seen=1
dfrig_cyx[go1]: INDEX USED  = mode & ATA_MODE_MASK = 0x0c & 0x0f = 12   (piotiming[] has 5 elements: 0..4)  <<< OUT OF BOUNDS
dfrig_cyx[go1]: INDEX RIGHT = ata_mode2idx(mode)   = 4   (the idiom every sibling uses)
dfrig_cyx[go1]: CORRECT VALUE piotiming[4] = 0x00040010 (source constant)
dfrig_cyx[go1]: controller register file (fabricated BMIO MEM space):
dfrig_cyx[go1]:   reg 0x20 (PIO timing, devno 0)  = 0x00911030
dfrig_cyx[go1]:   reg 0x24 (DMA timing, devno 0)  = 0x00000000
dfrig_cyx[go1]: OOB SOURCE kernel_mem[piotiming+12*4] = 0x00911030  == reg 0x20 write  (OOB read CONFIRMED)
dfrig_cyx: kernel .rodata piotiming[] @ 0xffffffff80d0cd20 (verified: [0..4] == source constants):
dfrig_cyx:   [ 0] @+0x00 = 0x00009172  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 1] @+0x04 = 0x00012171  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 2] @+0x08 = 0x00020080  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 3] @+0x0c = 0x00032010  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 4] @+0x10 = 0x00040010  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 5] @+0x14 = 0x00000000  OOB: pad hole
dfrig_cyx:   [ 6] @+0x18 = 0x00077771  OOB: dmatiming[0]
dfrig_cyx:   [ 7] @+0x1c = 0x00012121  OOB: dmatiming[1]
dfrig_cyx:   [ 8] @+0x20 = 0x00002020  OOB: dmatiming[2]  <-- PIO0 (0x08) lands here
dfrig_cyx:   [ 9] @+0x24 = 0x00000000  OOB: pad hole      <-- PIO1 (0x09) lands here
dfrig_cyx:   [10] @+0x28 = 0x00921250  OOB: udmatiming[0] <-- PIO2 (0x0a) lands here
dfrig_cyx:   [11] @+0x2c = 0x00911140  OOB: udmatiming[1] <-- PIO3 (0x0b) lands here
dfrig_cyx:   [12] @+0x30 = 0x00911030  OOB: udmatiming[2] <-- PIO4 (0x0c) lands here
dfrig_cyx:   [13] @+0x34 = 0x00000000  OOB: unrelated driver constant
dfrig_cyx[go2]: BEFORE dispatch: ch->dma=0xffffffff82601020 ctlr->r_res1=0xffffffff82601800 (guard ata-cyrix.c:84 passes) atadev->unit=0
dfrig_cyx[go2]: dispatching production ata_cyrix_setmode(dev, 0x0f) (verbatim #included copy)
dfrig_cyx[go2]: RETURNED: ch->dma->alignment=16 max_iosize=32768
dfrig_cyx[go2]: requested mode=0x0f settled mode=0x0c controlcmd_seen=1
dfrig_cyx[go2]: INDEX USED  = mode & ATA_MODE_MASK = 0x0c & 0x0f = 12   (piotiming[] has 5 elements: 0..4)  <<< OUT OF BOUNDS
dfrig_cyx[go2]: INDEX RIGHT = ata_mode2idx(mode)   = 4   (the idiom every sibling uses)
dfrig_cyx[go2]: CORRECT VALUE piotiming[4] = 0x00040010 (source constant)
dfrig_cyx[go2]: controller register file (fabricated BMIO MEM space):
dfrig_cyx[go2]:   reg 0x20 (PIO timing, devno 0)  = 0x00911030
dfrig_cyx[go2]:   reg 0x24 (DMA timing, devno 0)  = 0x00000000
dfrig_cyx[go2]: OOB SOURCE kernel_mem[piotiming+12*4] = 0x00911030  == reg 0x20 write  (OOB read CONFIRMED)
dfrig_cyx: kernel .rodata piotiming[] @ 0xffffffff80d0cd20 (verified: [0..4] == source constants):
dfrig_cyx:   [ 0] @+0x00 = 0x00009172  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 1] @+0x04 = 0x00012171  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 2] @+0x08 = 0x00020080  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 3] @+0x0c = 0x00032010  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 4] @+0x10 = 0x00040010  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 5] @+0x14 = 0x00000000  OOB: pad hole
dfrig_cyx:   [ 6] @+0x18 = 0x00077771  OOB: dmatiming[0]
dfrig_cyx:   [ 7] @+0x1c = 0x00012121  OOB: dmatiming[1]
dfrig_cyx:   [ 8] @+0x20 = 0x00002020  OOB: dmatiming[2]  <-- PIO0 (0x08) lands here
dfrig_cyx:   [ 9] @+0x24 = 0x00000000  OOB: pad hole      <-- PIO1 (0x09) lands here
dfrig_cyx:   [10] @+0x28 = 0x00921250  OOB: udmatiming[0] <-- PIO2 (0x0a) lands here
dfrig_cyx:   [11] @+0x2c = 0x00911140  OOB: udmatiming[1] <-- PIO3 (0x0b) lands here
dfrig_cyx:   [12] @+0x30 = 0x00911030  OOB: udmatiming[2] <-- PIO4 (0x0c) lands here
dfrig_cyx:   [13] @+0x34 = 0x00000000  OOB: unrelated driver constant
dfrig_cyx[go3]: BEFORE dispatch: ch->dma=0xffffffff82601020 ctlr->r_res1=0xffffffff82601800 (guard ata-cyrix.c:84 passes) atadev->unit=0
dfrig_cyx[go3]: dispatching production ata_cyrix_setmode(dev, 0x0f) (RUNNING KERNEL own copy)
dfrig_cyx[go3]: RETURNED: ch->dma->alignment=16 max_iosize=32768
dfrig_cyx[go3]: requested mode=0x0f settled mode=0x08 controlcmd_seen=1
dfrig_cyx[go3]: INDEX USED  = mode & ATA_MODE_MASK = 0x08 & 0x0f = 8   (piotiming[] has 5 elements: 0..4)  <<< OUT OF BOUNDS
dfrig_cyx[go3]: INDEX RIGHT = ata_mode2idx(mode)   = 0   (the idiom every sibling uses)
dfrig_cyx[go3]: CORRECT VALUE piotiming[0] = 0x00009172 (source constant)
dfrig_cyx[go3]: controller register file (fabricated BMIO MEM space):
dfrig_cyx[go3]:   reg 0x20 (PIO timing, devno 0)  = 0x00002020
dfrig_cyx[go3]:   reg 0x24 (DMA timing, devno 0)  = 0x00000000
dfrig_cyx[go3]: OOB SOURCE kernel_mem[piotiming+8*4] = 0x00002020  == reg 0x20 write  (OOB read CONFIRMED)
dfrig_cyx: kernel .rodata piotiming[] @ 0xffffffff80d0cd20 (verified: [0..4] == source constants):
dfrig_cyx:   [ 0] @+0x00 = 0x00009172  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 1] @+0x04 = 0x00012171  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 2] @+0x08 = 0x00020080  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 3] @+0x0c = 0x00032010  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 4] @+0x10 = 0x00040010  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 5] @+0x14 = 0x00000000  OOB: pad hole
dfrig_cyx:   [ 6] @+0x18 = 0x00077771  OOB: dmatiming[0]
dfrig_cyx:   [ 7] @+0x1c = 0x00012121  OOB: dmatiming[1]
dfrig_cyx:   [ 8] @+0x20 = 0x00002020  OOB: dmatiming[2]  <-- PIO0 (0x08) lands here
dfrig_cyx:   [ 9] @+0x24 = 0x00000000  OOB: pad hole      <-- PIO1 (0x09) lands here
dfrig_cyx:   [10] @+0x28 = 0x00921250  OOB: udmatiming[0] <-- PIO2 (0x0a) lands here
dfrig_cyx:   [11] @+0x2c = 0x00911140  OOB: udmatiming[1] <-- PIO3 (0x0b) lands here
dfrig_cyx:   [12] @+0x30 = 0x00911030  OOB: udmatiming[2] <-- PIO4 (0x0c) lands here
dfrig_cyx:   [13] @+0x34 = 0x00000000  OOB: unrelated driver constant
dfrig_cyx[go4]: BEFORE: requested mode=ATA_UDMA2 -- full extracted call site ata-pci.c:855-866 (call1 = ctlr->setmode(dev, ATA_PIO_MAX), call2 = ctlr->setmode(dev, 0x42))
dfrig_cyx[go4]: RETURNED: alignment=16 max_iosize=32768 controlcmd_seen=2 (2 SETXFER = normal)
dfrig_cyx[go4]: requested mode=0x42 settled mode=0x42 controlcmd_seen=2
dfrig_cyx[go4]: INDEX USED  = mode & ATA_MODE_MASK = 0x42 & 0x0f = 2   (piotiming[] has 5 elements: 0..4)
dfrig_cyx[go4]: controller register file (fabricated BMIO MEM space):
dfrig_cyx[go4]:   reg 0x20 (PIO timing, devno 0)  = 0x00911030
dfrig_cyx[go4]:   reg 0x24 (DMA timing, devno 0)  = 0x00911030
dfrig_cyx: kernel .rodata piotiming[] @ 0xffffffff80d0cd20 (verified: [0..4] == source constants):
dfrig_cyx:   [ 0] @+0x00 = 0x00009172  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 1] @+0x04 = 0x00012171  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 2] @+0x08 = 0x00020080  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 3] @+0x0c = 0x00032010  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 4] @+0x10 = 0x00040010  IN BOUNDS (piotiming[i])
dfrig_cyx:   [ 5] @+0x14 = 0x00000000  OOB: pad hole
dfrig_cyx:   [ 6] @+0x18 = 0x00077771  OOB: dmatiming[0]
dfrig_cyx:   [ 7] @+0x1c = 0x00012121  OOB: dmatiming[1]
dfrig_cyx:   [ 8] @+0x20 = 0x00002020  OOB: dmatiming[2]  <-- PIO0 (0x08) lands here
dfrig_cyx:   [ 9] @+0x24 = 0x00000000  OOB: pad hole      <-- PIO1 (0x09) lands here
dfrig_cyx:   [10] @+0x28 = 0x00921250  OOB: udmatiming[0] <-- PIO2 (0x0a) lands here
dfrig_cyx:   [11] @+0x2c = 0x00911140  OOB: udmatiming[1] <-- PIO3 (0x0b) lands here
dfrig_cyx:   [12] @+0x30 = 0x00911030  OOB: udmatiming[2] <-- PIO4 (0x0c) lands here
dfrig_cyx:   [13] @+0x34 = 0x00000000  OOB: unrelated driver constant
dfrig_cyx[go5]: BEFORE dispatch: ch->dma=0xffffffff82601020 ctlr->r_res1=0xffffffff82601800 (guard ata-cyrix.c:84 passes) atadev->unit=0
dfrig_cyx[go5]: dispatching production ata_cyrix_setmode(dev, 0x22) (RUNNING KERNEL own copy)
dfrig_cyx[go5]: RETURNED: ch->dma->alignment=16 max_iosize=32768
dfrig_cyx[go5]: requested mode=0x22 settled mode=0x22 controlcmd_seen=1
dfrig_cyx[go5]: INDEX USED  = mode & ATA_MODE_MASK = 0x22 & 0x0f = 2   (piotiming[] has 5 elements: 0..4)
dfrig_cyx[go5]: controller register file (fabricated BMIO MEM space):
dfrig_cyx[go5]:   reg 0x20 (PIO timing, devno 0)  = 0x00000000
dfrig_cyx[go5]:   reg 0x24 (DMA timing, devno 0)  = 0x00002020