DFH:   +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[cmd] damaged_qwords(out of 35)=0
DFH: dump[cmd] victim=0xfffff8004f296c20 (was softc) pending_queue.tqh_first=0x4141414141414141 (0x41 canary intact unless TAILQ_REMOVE wrote after free; NULL write expected on UAF)
DFH: dump[cmd] pending_queue.tqh_last=0x4141414141414141 (self-pointer softc+0 written by TAILQ_REMOVE on UAF)
DFH: dump[victim] chunk=0xfffff8004f296c20 size=280 (canary fill 0x41)
DFH:   +00: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +16: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +32: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +48: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[victim] damaged_qwords(out of 35)=0
DFH: status: ctor=1 dtor_started=1 dtor_done=1 dtor_ticks=65 ctio_held=1 softc=0xfffff8004f296c20 freed=1 postfree=0 rearm=0 periph_poisoned=0 victim=1 abortmode=1
DFH: complete: firing held CTIO 0xfffff801183d23c0 into targbhdone (outstanding 699 ticks, hz/2=50) softc_freed=1
panic: Bad link elm 0xfffff8008db00cc0 prev->next != elm
cpuid = 0
Trace beginning at frame 0xfffff80117df16e8
targbhdone() at targbhdone+0x439 0xffffffff80a80709 
targbhdone() at targbhdone+0x439 0xffffffff80a80709 
dfh_cmd_sysctl() at dfh_cmd_sysctl+0xa91 0xffffffff80a817c1 
sysctl_root.isra.5() at sysctl_root.isra.5+0x166 0xffffffff80683d26 
userland_sysctl() at userland_sysctl+0x111 0xffffffff806840c1 
sys___sysctl() at sys___sysctl+0x74 0xffffffff80684224 
Debugger("panic")

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdc389(%rip)
db>