DF-2285 / fix_run.log
Copyright (c) 2003-2026 The DragonFly Project.
Copyright (c) 1992-2003 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026
root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC
acpi_hpet: frequency 100000000
Using cputimer HPET for TSC calibration
Timer latency (in TSC ticks): 32370 min=32174 max=32668
TSC clock: 3600006058 Hz, NOT invariant
CPU: QEMU Virtual CPU version 2.5+ (3600.01-MHz K8-class CPU)
Origin="GenuineIntel" Id=0x60fb1 Family=0xf Model=0x6b Stepping=1
Features=0x1783fbfd<FPU,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR,SSE,SSE2,HTT>
Features2=0x80202001<SSE3,CX16,x2APIC,VMM>
AMD Features=0x20100800<SYSCALL,NX,LM>
AMD Features2=0x1<LAHF>
MONITOR/MWAIT Features=0x2<INTBRK>
VMM/Hypervisor: Origin="KVMKVMKVM"
real memory = 4293381120 (4094 MB)
avail memory = 4088926208 (3899 MB)
LAPIC: enter X2APIC mode
madt_lapic_probe: lapic_count=6 x2apic_count=0
ACPI CPUS = 6
lapic: divisor index 0, frequency 500002956 Hz
CPU Topology: cores_per_chip: 6; threads_per_core: 1; chips_per_package: 1;
srat_probe: can't locate SRAT
SMI Frequency (worst case): 37037 Hz (27 us)
Initialize MI interrupts for 6 cpus
TSC is not invariant, no further tests will be performed
Spectre: support=( none ) req=ffff operating=( none )
MDS: support=( none ) req=ffff operating=( none )
machdep.meltdown_mitigation enabled to protect against (mostly Intel) meltdown bug
system call performance will be impacted
interrupt uses mplock: swi_taskq
wdog: In-kernel automatic watchdog reset enabled
md0: Malloc disk
evdev device loaded.
kbd1 at kbdmux0
ACPI: RSDP 0x00000000000F59A0 000014 (v00 BOCHS )
ACPI: RSDT 0x00000000BFFE1CAC 000034 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: FACP 0x00000000BFFE1B38 000074 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: DSDT 0x00000000BFFE0040 001AF8 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: FACS 0x00000000BFFE0000 000040
ACPI: APIC 0x00000000BFFE1BAC 0000A0 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: HPET 0x00000000BFFE1C4C 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: WAET 0x00000000BFFE1C84 000028 (v01 BOCHS BXPC 00000001 BXPC 00000001)
sc0: <System console> on motherboard
sc0: VGA <16 virtual consoles, flags=0x100>
acpi0: <BOCHS BXPC> on motherboard
ACPI: 1 ACPI AML tables successfully acquired and loaded
ACPI FADT: SCI testing interrupt mode ...
ACPI FADT: SCI select level/high
acpi0: Power Button (fixed)
acpi_hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
acpi_timer0 on acpi0
isab0: <ACPI Generic ISA bridge> on acpi0
isa0: <ISA bus> on isab0
cpu0: <ACPI CPU> on acpi0
cpu_cst0: <ACPI CPU C-State> on cpu0
cpu1: <ACPI CPU> on acpi0
cpu_cst1: <ACPI CPU C-State> on cpu1
cpu2: <ACPI CPU> on acpi0
cpu_cst2: <ACPI CPU C-State> on cpu2
cpu3: <ACPI CPU> on acpi0
cpu_cst3: <ACPI CPU C-State> on cpu3
cpu4: <ACPI CPU> on acpi0
cpu_cst4: <ACPI CPU C-State> on cpu4
cpu5: <ACPI CPU> on acpi0
cpu_cst5: <ACPI CPU C-State> on cpu5
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
isab1: <PCI-ISA bridge> at device 1.0 on pci0
isa1: <ISA bus> on isab1
atapci0: <Intel PIIX3 WDMA2 controller> port 0xc0a0-0xc0af,0x376,0x170-0x177,0x3f6,0x1f0-0x1f7 at device 1.1 on pci0
ata0: <ATA channel 0> on atapci0
interrupt uses mplock: ata0
ata1: <ATA channel 1> on atapci0
interrupt uses mplock: ata1
acd0: DVDROM <QEMU DVD-ROM/2.5+> at ata1-master WDMA2
pci0: <bridge> (vendor 0x8086, dev 0x7113) at device 1.3 irq 9
vgapci0: <VGA-compatible display> mem 0xfebd0000-0xfebd0fff,0xfd000000-0xfdffffff at device 2.0 on pci0
vgapci0: Boot video device
virtio_pci0: <VirtIO PCI Network adapter> port 0xc080-0xc09f mem 0xfe000000-0xfe003fff,0xfebd1000-0xfebd1fff irq 11 at device 3.0 on pci0
vtnet0: <VirtIO Networking Adapter> on virtio_pci0
virtio_pci0: host features: 0x79bf8064 <EventIdx,RingIndirect,AnyLayout,NotifyOnEmpty,SetMacAddress,GuestAnnounce,RxModeExtra,VLanFilter,RxMode,ControlVq,Status,MrgRxBuf,TxAllGSO,MacAddress,DynOffload>
virtio_pci0: negotiated features: 0x198f8020 <RingIndirect,AnyLayout,NotifyOnEmpty,SetMacAddress,VLanFilter,RxMode,ControlVq,Status,MrgRxBuf,MacAddress>
virtio_pci0: using 3 MSI-X vectors
vtnet0: MAC address: 52:54:00:12:34:56
virtio_pci1: <VirtIO PCI Block adapter> port 0xc000-0xc07f mem 0xfe004000-0xfe007fff,0xfebd2000-0xfebd2fff irq 11 at device 4.0 on pci0
vtblk0: <VirtIO Block Adapter> on virtio_pci1
virtio_pci1: host features: 0x79007e54 <EventIdx,RingIndirect,AnyLayout,NotifyOnEmpty,WriteZeroes,Discard,MultiQueue,ConfigWCE,Topology,FlushCommand,BlockSize,DiskGeometry,MaxNumSegs>
virtio_pci1: negotiated features: 0x10001a54 <RingIndirect,MultiQueue,ConfigWCE,FlushCommand,BlockSize,DiskGeometry,MaxNumSegs>
virtio_pci1: using 6 MSI-X vectors
vtblk0: Virtio: ncylinders at legacy maximum (16383), recalculating to 62415
vtblk0: Block size: 512
vtblk0: 30720MB (62914560 512 byte sectors: 16H 63S/T 16383C)
atkbdc0: <Keyboard controller (i8042)> port 0x64,0x60 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
psm0: <PS/2 Mouse> irq 12 on atkbdc0
interrupt uses mplock: psm0
psm0: model IntelliMouse Explorer, device ID 4
sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 on acpi0
sio0: type 16550A, console
ACPI: Enabled 2 GPEs in block 00 to 0F
rdrand0: No RdRand support.
orm0: <ISA Option ROM> at iomem 0xe8000-0xeffff on isa1
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa1
sio2: can't drain, serial port might not exist, disabling
hpt27xx: no controller detected.
CAM: Configuring 2 busses
CAM: finished configuring all busses
cd0 at ata1 bus 0 target 0 lun 0
cd0: <QEMU QEMU DVD-ROM 2.5+> Removable CD-ROM SCSI-0 device
cd0: 16.000MB/s transfers
cd0: Attempt to query device size failed: NOT READY, Medium not present
Mounting root from hammer2:vbd0s1d
hammer2_mount: root devstr="vbd0s1d"
hammer2_mount: device="vbd0s1d" label="ROOT" rdonly=1
hammer2_ondisk: "/dev/vbd0s1d" zone=2 id=0 offset=0x0000000000000000 size=0x000000063f000000
hammer2_mount: hmp=0xfffff8008fae0000 pmp=0xfffff80090280000
DMA space used: 13580k, remaining available: 131072k
Mounting devfs
hammer2_mount: "vbd0s1d": no recovery needed
hammer2: enable read/write
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
swap low/high-water marks set to 41940/62910
boot() called on cpu#1
Switching to cpu #0 for shutdown
Waiting (max 60 seconds) for system thread swapcached to stop...stopped
Waiting (max 60 seconds) for system thread vnlru to stop...stopped
Waiting (max 60 seconds) for system thread consttyd to stop...stopped
Waiting (max 60 seconds) for system thread bufdaemon to stop...stopped
Waiting (max 60 seconds) for system thread bufdaemon_hw to stop...stopped
syncing disks... 0 0 0
done
v-chain 0xfffff8008fb604c0 volume.0 0000000000000010 0000000000000000/0 mir=00000000000000d4
[00002000] (?) refs=1
f-chain 0xfffff8008fb60640 freemap.0 0000000000000010 0000000000000000/0 mir=00000000000000d4
[00002000] (?) refs=1
Uptime: 11m48s
Rebooting...
Copyright (c) 2003-2026 The DragonFly Project.
Copyright (c) 1992-2003 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
DragonFly 6.5-DEVELOPMENT #1: Sun Oct 18 03:32:40 UTC 2026
root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC
acpi_hpet: frequency 100000000
Using cputimer HPET for TSC calibration
Timer latency (in TSC ticks): 32099 min=31840 max=33184
TSC clock: 3600008486 Hz, NOT invariant
CPU: QEMU Virtual CPU version 2.5+ (3600.01-MHz K8-class CPU)
Origin="GenuineIntel" Id=0x60fb1 Family=0xf Model=0x6b Stepping=1
Features=0x1783fbfd<FPU,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR,SSE,SSE2,HTT>
Features2=0x80202001<SSE3,CX16,x2APIC,VMM>
AMD Features=0x20100800<SYSCALL,NX,LM>
AMD Features2=0x1<LAHF>
MONITOR/MWAIT Features=0x2<INTBRK>
VMM/Hypervisor: Origin="KVMKVMKVM"
real memory = 4293381120 (4094 MB)
avail memory = 4088795136 (3899 MB)
LAPIC: enter X2APIC mode
madt_lapic_probe: lapic_count=6 x2apic_count=0
ACPI CPUS = 6
lapic: divisor index 0, frequency 500002976 Hz
CPU Topology: cores_per_chip: 6; threads_per_core: 1; chips_per_package: 1;
srat_probe: can't locate SRAT
SMI Frequency (worst case): 37037 Hz (27 us)
Initialize MI interrupts for 6 cpus
TSC is not invariant, no further tests will be performed
Spectre: support=( none ) req=ffff operating=( none )
MDS: support=( none ) req=ffff operating=( none )
machdep.meltdown_mitigation enabled to protect against (mostly Intel) meltdown bug
system call performance will be impacted
interrupt uses mplock: swi_taskq
wdog: In-kernel automatic watchdog reset enabled
md0: Malloc disk
evdev device loaded.
kbd1 at kbdmux0
ACPI: RSDP 0x00000000000F59A0 000014 (v00 BOCHS )
ACPI: RSDT 0x00000000BFFE1CAC 000034 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: FACP 0x00000000BFFE1B38 000074 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: DSDT 0x00000000BFFE0040 001AF8 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: FACS 0x00000000BFFE0000 000040
ACPI: APIC 0x00000000BFFE1BAC 0000A0 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: HPET 0x00000000BFFE1C4C 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: WAET 0x00000000BFFE1C84 000028 (v01 BOCHS BXPC 00000001 BXPC 00000001)
sc0: <System console> on motherboard
sc0: VGA <16 virtual consoles, flags=0x100>
acpi0: <BOCHS BXPC> on motherboard
ACPI: 1 ACPI AML tables successfully acquired and loaded
ACPI FADT: SCI testing interrupt mode ...
ACPI FADT: SCI select level/high
acpi0: Power Button (fixed)
acpi_hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
acpi_timer0 on acpi0
isab0: <ACPI Generic ISA bridge> on acpi0
isa0: <ISA bus> on isab0
cpu0: <ACPI CPU> on acpi0
cpu_cst0: <ACPI CPU C-State> on cpu0
cpu1: <ACPI CPU> on acpi0
cpu_cst1: <ACPI CPU C-State> on cpu1
cpu2: <ACPI CPU> on acpi0
cpu_cst2: <ACPI CPU C-State> on cpu2
cpu3: <ACPI CPU> on acpi0
cpu_cst3: <ACPI CPU C-State> on cpu3
cpu4: <ACPI CPU> on acpi0
cpu_cst4: <ACPI CPU C-State> on cpu4
cpu5: <ACPI CPU> on acpi0
cpu_cst5: <ACPI CPU C-State> on cpu5
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
isab1: <PCI-ISA bridge> at device 1.0 on pci0
isa1: <ISA bus> on isab1
atapci0: <Intel PIIX3 WDMA2 controller> port 0xc0a0-0xc0af,0x376,0x170-0x177,0x3f6,0x1f0-0x1f7 at device 1.1 on pci0
ata0: <ATA channel 0> on atapci0
interrupt uses mplock: ata0
ata1: <ATA channel 1> on atapci0
interrupt uses mplock: ata1
acd0: DVDROM <QEMU DVD-ROM/2.5+> at ata1-master WDMA2
pci0: <bridge> (vendor 0x8086, dev 0x7113) at device 1.3 irq 9
vgapci0: <VGA-compatible display> mem 0xfebd0000-0xfebd0fff,0xfd000000-0xfdffffff at device 2.0 on pci0
vgapci0: Boot video device
virtio_pci0: <VirtIO PCI Network adapter> port 0xc080-0xc09f mem 0xfe000000-0xfe003fff,0xfebd1000-0xfebd1fff irq 11 at device 3.0 on pci0
vtnet0: <VirtIO Networking Adapter> on virtio_pci0
virtio_pci0: host features: 0x79bf8064 <EventIdx,RingIndirect,AnyLayout,NotifyOnEmpty,SetMacAddress,GuestAnnounce,RxModeExtra,VLanFilter,RxMode,ControlVq,Status,MrgRxBuf,TxAllGSO,MacAddress,DynOffload>
virtio_pci0: negotiated features: 0x198f8020 <RingIndirect,AnyLayout,NotifyOnEmpty,SetMacAddress,VLanFilter,RxMode,ControlVq,Status,MrgRxBuf,MacAddress>
virtio_pci0: using 3 MSI-X vectors
vtnet0: MAC address: 52:54:00:12:34:56
virtio_pci1: <VirtIO PCI Block adapter> port 0xc000-0xc07f mem 0xfe004000-0xfe007fff,0xfebd2000-0xfebd2fff irq 11 at device 4.0 on pci0
vtblk0: <VirtIO Block Adapter> on virtio_pci1
virtio_pci1: host features: 0x79007e54 <EventIdx,RingIndirect,AnyLayout,NotifyOnEmpty,WriteZeroes,Discard,MultiQueue,ConfigWCE,Topology,FlushCommand,BlockSize,DiskGeometry,MaxNumSegs>
virtio_pci1: negotiated features: 0x10001a54 <RingIndirect,MultiQueue,ConfigWCE,FlushCommand,BlockSize,DiskGeometry,MaxNumSegs>
virtio_pci1: using 6 MSI-X vectors
vtblk0: Virtio: ncylinders at legacy maximum (16383), recalculating to 62415
vtblk0: Block size: 512
vtblk0: 30720MB (62914560 512 byte sectors: 16H 63S/T 16383C)
atkbdc0: <Keyboard controller (i8042)> port 0x64,0x60 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
psm0: <PS/2 Mouse> irq 12 on atkbdc0
interrupt uses mplock: psm0
psm0: model IntelliMouse Explorer, device ID 4
sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 on acpi0
sio0: type 16550A, console
ACPI: Enabled 2 GPEs in block 00 to 0F
rdrand0: No RdRand support.
orm0: <ISA Option ROM> at iomem 0xe8000-0xeffff on isa1
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa1
sio2: can't drain, serial port might not exist, disabling
hpt27xx: no controller detected.
CAM: Configuring 2 busses
CAM: finished configuring all busses
DFH: xpt_register_async(0x60) swallowed by harness (driver inert at boot)
cd0 at ata1 bus 0 target 0 lun 0
cd0: <QEMU QEMU DVD-ROM 2.5+> Removable CD-ROM SCSI-0 device
cd0: 16.000MB/s transfers
cd0: Attempt to query device size failed: NOT READY, Medium not present
Mounting root from hammer2:vbd0s1d
hammer2_mount: root devstr="vbd0s1d"
hammer2_mount: device="vbd0s1d" label="ROOT" rdonly=1
hammer2_ondisk: "/dev/vbd0s1d" zone=1 id=0 offset=0x0000000000000000 size=0x000000063f000000
hammer2_mount: hmp=0xfffff8008fae0000 pmp=0xfffff80090280000
DMA space used: 13580k, remaining available: 131072k
Mounting devfs
hammer2_mount: "vbd0s1d": no recovery needed
hammer2: enable read/write
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
swap low/high-water marks set to 41940/62910
DFH: sim: XPT_EN_LUN enable=1
DFH: ctor: targbhctor -> 0x1; softc=0xfffff80117b3e000 size=288 sizeof(targbh_softc)=288 state_off=248 pending_off=0 work_off=16
DFH: ctor: fake SIM pools: atio=8 in=8
DFH: dtor thread: calling targbhdtor (ticks=9373)
DFH: sim: XPT_ABORT idle ATIO 0xfffff80118455fc0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff80118455cc0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff801184559c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff801184556c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff801184553c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff801184550c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff80118454dc0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff80118454ac0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT IN 0xfffff801184577c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff801184574c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff801184571c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff80118456ec0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff80118456bc0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff801184568c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff801184565c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff801184562c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_EN_LUN enable=0
DFH: kfree(softc=0xfffff80117b3e000 size=288) (CTIO still not held)
DFH: dtor thread: targbhdtor RETURNED after 65 ticks (hz/2=50); softc_freed=1
DFH: reclaim: canary victim 0xfffff80117b3e000 (0x41-filled, size 288) == freed softc chunk (SAME CHUNK reclaimed)
DFH: dtorwait: 1
DFH: dump[cmd] chunk=0xfffff80117b3e000 size=288 (canary fill 0x41)
DFH: +00: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +16: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +32: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +48: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[cmd] damaged_qwords(out of 36)=0
DFH: dump[cmd] victim=0xfffff80117b3e000 (was softc) pending_queue.tqh_first=0x4141414141414141 (0x41 canary intact unless TAILQ_REMOVE wrote after free; NULL write expected on UAF)
DFH: dump[cmd] pending_queue.tqh_last=0x4141414141414141 (self-pointer softc+0 written by TAILQ_REMOVE on UAF)
DFH: dump[victim] chunk=0xfffff80117b3e000 size=288 (canary fill 0x41)
DFH: +00: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +16: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +32: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +48: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[victim] damaged_qwords(out of 36)=0
DFH: sim: XPT_EN_LUN enable=1
DFH: ctor: targbhctor -> 0x1; softc=0xfffff80117bf4280 size=288 sizeof(targbh_softc)=288 state_off=248 pending_off=0 work_off=16
DFH: ctor: fake SIM pools: atio=8 in=8
DFH: inquiry: initiator 7 selects LUN, ATIO 0xfffff8008f994ac0 completed to periph with INQUIRY CDB
DFH: xpt schedules targbhstart (priority 1)
DFH: sim: CTIO 0xfffff80118457ac0 ACCEPTED AND HELD at fake SIM (stalled initiator; ticks=9946)
DFH: complete: firing held CTIO 0xfffff80118457ac0 into targbhdone (outstanding 129 ticks, hz/2=50) softc_freed=0
DFH: complete: targbhdone returned; postfree_actions=0 rearm_after_free=0
DFH: dtor thread: calling targbhdtor (ticks=10205)
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008f995fc0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008f995cc0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008f9959c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008f9956c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008f9953c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008f9950c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008f994dc0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008f994ac0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT IN 0xfffff8008f9977c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008f9974c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008f9971c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008f996ec0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008f996bc0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008f9968c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008f9965c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008f9962c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_EN_LUN enable=0
DFH: kfree(softc=0xfffff80117bf4280 size=288) (CTIO still not held)
DFH: dtor thread: targbhdtor RETURNED after 66 ticks (hz/2=50); softc_freed=1
DFH: reclaim: canary victim 0xfffff80117bf4280 (0x41-filled, size 288) == freed softc chunk (SAME CHUNK reclaimed)
DFH: dtorwait: 1
DFH: dump[cmd] chunk=0xfffff80117bf4280 size=288 (canary fill 0x41)
DFH: +00: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +16: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +32: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +48: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[cmd] damaged_qwords(out of 36)=0
DFH: dump[cmd] victim=0xfffff80117bf4280 (was softc) pending_queue.tqh_first=0x4141414141414141 (0x41 canary intact unless TAILQ_REMOVE wrote after free; NULL write expected on UAF)
DFH: dump[cmd] pending_queue.tqh_last=0x4141414141414141 (self-pointer softc+0 written by TAILQ_REMOVE on UAF)
DFH: dump[victim] chunk=0xfffff80117bf4280 size=288 (canary fill 0x41)
DFH: +00: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +16: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +32: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +48: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[victim] damaged_qwords(out of 36)=0
DFH: sim: XPT_EN_LUN enable=1
DFH: ctor: targbhctor -> 0x1; softc=0xfffff8004f296c20 size=288 sizeof(targbh_softc)=288 state_off=248 pending_off=0 work_off=16
DFH: ctor: fake SIM pools: atio=8 in=8
DFH: inquiry: initiator 7 selects LUN, ATIO 0xfffff8008db00cc0 completed to periph with INQUIRY CDB
DFH: xpt schedules targbhstart (priority 1)
DFH: sim: CTIO 0xfffff8008db02dc0 ACCEPTED AND HELD at fake SIM (stalled initiator; ticks=10753)
DFH: dtor thread: calling targbhdtor (ticks=10882)
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db1cbc0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db003c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db1fbc0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db1f8c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db1ddc0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db1dac0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db1d7c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT SELECTED ATIO 0xfffff8008db00cc0 -> CAM_REQ_CMP_ERR (SIM cannot abort a ccb owned by the periph; in-flight CTIO untracked)
DFH: sim: XPT_ABORT IN 0xfffff8008db02ac0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db027c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db024c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db021c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db01ec0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db01bc0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db1d4c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db1cec0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_EN_LUN enable=0
DFH: complete: firing held CTIO 0xfffff8008db02dc0 into targbhdone (outstanding 269 ticks, hz/2=50) softc_freed=0
DFH: complete: targbhdone returned; postfree_actions=0 rearm_after_free=0
DFH: kfree(softc=0xfffff8004f296c20 size=288) (CTIO still not held)
DFH: dtor thread: targbhdtor RETURNED after 192 ticks (hz/2=50); softc_freed=1
DFH: reclaim: canary victim 0xfffff8004f296c20 (0x41-filled, size 288) == freed softc chunk (SAME CHUNK reclaimed)
DFH: dtorwait: 1
DFH: dump[cmd] chunk=0xfffff8004f296c20 size=288 (canary fill 0x41)
DFH: +00: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +16: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +32: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +48: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[cmd] damaged_qwords(out of 36)=0
DFH: dump[cmd] victim=0xfffff8004f296c20 (was softc) pending_queue.tqh_first=0x4141414141414141 (0x41 canary intact unless TAILQ_REMOVE wrote after free; NULL write expected on UAF)
DFH: dump[cmd] pending_queue.tqh_last=0x4141414141414141 (self-pointer softc+0 written by TAILQ_REMOVE on UAF)
DFH: dump[victim] chunk=0xfffff8004f296c20 size=288 (canary fill 0x41)
DFH: +00: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +16: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +32: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +48: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[victim] damaged_qwords(out of 36)=0
DFH: status: ctor=1 dtor_started=1 dtor_done=1 dtor_ticks=192 ctio_held=0 softc=0xfffff8004f296c20 freed=1 postfree=0 rearm=0 periph_poisoned=0 victim=1 abortmode=1
DFH: sim: XPT_EN_LUN enable=1
DFH: ctor: targbhctor -> 0x1; softc=0xfffff8004f296d40 size=288 sizeof(targbh_softc)=288 state_off=248 pending_off=0 work_off=16
DFH: ctor: fake SIM pools: atio=8 in=8
DFH: inquiry: initiator 7 selects LUN, ATIO 0xfffff8008db00cc0 completed to periph with INQUIRY CDB
DFH: xpt schedules targbhstart (priority 1)
DFH: sim: CTIO 0xfffff80118457ac0 ACCEPTED AND HELD at fake SIM (stalled initiator; ticks=11701)
DFH: dtor thread: calling targbhdtor (ticks=11828)
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db021c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db01ec0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db01bc0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db1d4c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db1cec0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db030c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db02dc0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT SELECTED ATIO 0xfffff8008db00cc0 -> CAM_REQ_CMP_ERR (SIM cannot abort a ccb owned by the periph; in-flight CTIO untracked)
DFH: sim: XPT_ABORT IN 0xfffff8008db1fbc0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db1f8c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db1ddc0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db1dac0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db1d7c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db02ac0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db027c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db024c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_EN_LUN enable=0
DFH: reclaim: nothing to reclaim
DFH: complete: firing held CTIO 0xfffff80118457ac0 into targbhdone (outstanding 394 ticks, hz/2=50) softc_freed=0
DFH: complete: targbhdone returned; postfree_actions=0 rearm_after_free=0
DFH: kfree(softc=0xfffff8004f296d40 size=288) (CTIO still not held)
DFH: dtor thread: targbhdtor RETURNED after 319 ticks (hz/2=50); softc_freed=1
DFH: reclaim: canary victim 0xfffff8004f296d40 (0x41-filled, size 288) == freed softc chunk (SAME CHUNK reclaimed)
DFH: dtorwait: 1
DFH: dump[cmd] chunk=0xfffff8004f296d40 size=288 (canary fill 0x41)
DFH: +00: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +16: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +32: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +48: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[cmd] damaged_qwords(out of 36)=0
DFH: dump[cmd] victim=0xfffff8004f296d40 (was softc) pending_queue.tqh_first=0x4141414141414141 (0x41 canary intact unless TAILQ_REMOVE wrote after free; NULL write expected on UAF)
DFH: dump[cmd] pending_queue.tqh_last=0x4141414141414141 (self-pointer softc+0 written by TAILQ_REMOVE on UAF)
DFH: dump[victim] chunk=0xfffff8004f296d40 size=288 (canary fill 0x41)
DFH: +00: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +16: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +32: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +48: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[victim] damaged_qwords(out of 36)=0
DFH: status: ctor=1 dtor_started=1 dtor_done=1 dtor_ticks=319 ctio_held=0 softc=0xfffff8004f296d40 freed=1 postfree=0 rearm=0 periph_poisoned=0 victim=1 abortmode=1