+ echo '=== DF-2296 phase A: S400 (maxrec=10), req.len=4096, lenval=4080'
=== DF-2296 phase A: S400 (maxrec=10), req.len=4096, lenval=4080
+ /tmp/fwhctl maxrec 10
+ /tmp/fwhctl spray 24 2084
+ /tmp/fwhctl spray 240 160
+ /tmp/fwhctl sprayfree 150
+ dmesg -c
+ su -m opuser -c '/tmp/poc_2296 4096 4080'
DF-2296: FW_ASYREQ req.len=4096 -> bcopy pay_len=4080 (data[] capacity 2048, staging buffer 2084); lenval=4080 recvpaylen=0 M_FWXFER=0xffffffff810aaa40 (uid=1002 gid=1002)
DF-2296: fw_xfer send.payload=+80 recv.hdr=+96 recv.payload=+112 recv.pay_len=+120 mbuf=+128 malloc=+144
DF-2296: ioctl rc=-1 errno=22 (rejected by fw_asyreq AFTER the fwdev.c:560 bcopy already ran)
+ echo '--- dmesg (expect: send.pay_len > maxrec AFTER bcopy) ---'
--- dmesg (expect: send.pay_len > maxrec AFTER bcopy) ---
+ dmesg
+ tail -4
send.pay_len > maxrec
+ /tmp/fwhctl spraychk
fwhctl: spraychk corrupt=0 badwords=0
+ echo 'SPRAYCHK_RC=0'
SPRAYCHK_RC=0
+ /tmp/fwhctl spraydump /root/fw/spraydump.A1.txt 24
fwhctl: dumped 24 spray chunks to /root/fw/spraydump.A1.txt
+ /tmp/fwhctl spraydump /root/fw/spraydump.A2.txt 48
fwhctl: dumped 24 spray chunks to /root/fw/spraydump.A2.txt
+ /tmp/fwhctl unspray
+ sync
+ echo '=== DF-2296 phase B: S800 (maxrec=11), same request'
=== DF-2296 phase B: S800 (maxrec=11), same request
+ /tmp/fwhctl maxrec 11
+ /tmp/fwhctl spray 24 2084
+ /tmp/fwhctl spray 240 160
+ /tmp/fwhctl sprayfree 150
+ dmesg -c
+ su -m opuser -c '/tmp/poc_2296 4096 4080'
DF-2296: FW_ASYREQ req.len=4096 -> bcopy pay_len=4080 (data[] capacity 2048, staging buffer 2084); lenval=4080 recvpaylen=0 M_FWXFER=0xffffffff810aaa40 (uid=1002 gid=1002)
DF-2296: fw_xfer send.payload=+80 recv.hdr=+96 recv.payload=+112 recv.pay_len=+120 mbuf=+128 malloc=+144
DF-2296: ioctl rc=0 errno=0 (full path completed (fw_asyreq/fw_asystart ran))
+ echo '--- dmesg (expect: AT-START + full path) ---'
--- dmesg (expect: AT-START + full path) ---
+ dmesg
+ tail -6
fwh: AT-START: 'wire' payload snapshot 4080 bytes (wire count=1)
fw_xfer_free FWXF_INQ
+ /tmp/fwhctl spraychk
fwhctl: spraychk corrupt=0 badwords=0
+ echo 'SPRAYCHK_RC=0'
SPRAYCHK_RC=0
+ /tmp/fwhctl spraydump /root/fw/spraydump.B1.txt 24
fwhctl: dumped 24 spray chunks to /root/fw/spraydump.B1.txt
+ /tmp/fwhctl spraydump /root/fw/spraydump.B2.txt 96
fwhctl: dumped 24 spray chunks to /root/fw/spraydump.B2.txt
+ /tmp/fwhctl unspray
+ sync
+ echo '=== DF-2296 phase C: response-path write variant (recvpl=2304)'
=== DF-2296 phase C: response-path write variant (recvpl=2304)
+ /tmp/fwhctl maxrec 11
+ /tmp/fwhctl spray 24 2084
+ /tmp/fwhctl spraypop
+ /tmp/fwhctl spray 240 160
+ /tmp/fwhctl sprayfree 150
+ /tmp/fwhctl resp 2304 0xC2
+ dmesg -c
+ su -m opuser -c '/tmp/poc_2296 4096 4080 2304'
DF-2296: FW_ASYREQ req.len=4096 -> bcopy pay_len=4080 (data[] capacity 2048, staging buffer 2084); lenval=4080 recvpaylen=2304 M_FWXFER=0xffffffff810aaa40 (uid=1002 gid=1002)
DF-2296: fw_xfer send.payload=+80 recv.hdr=+96 recv.payload=+112 recv.pay_len=+120 mbuf=+128 malloc=+144
DF-2296: ioctl rc=0 errno=0 (full path completed (fw_asyreq/fw_asystart ran))
+ echo '--- dmesg ---'
--- dmesg ---
+ dmesg
+ tail -6
fwh: AT-START: 'wire' payload snapshot 4080 bytes (wire count=2)
fw_xfer_free FWXF_INQ
+ /tmp/fwhctl spraychk
fwhctl: spraychk corrupt=1 badwords=576
+ echo 'SPRAYCHK_RC=3'
SPRAYCHK_RC=3
+ /tmp/fwhctl spraydump /root/fw/spraydump.C.txt 0
fwhctl: dumped 23 spray chunks to /root/fw/spraydump.C.txt
+ /tmp/fwhctl unspray
+ /tmp/fwhctl resp 0 0
+ sync
+ echo RUN_2296_DONE
RUN_2296_DONE