DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 cc 8.3 [DragonFly] Release/2019-02-22 4 1 0xffffffff82600000 d000 df229x.ko kern.df229x_status: guard: esize=0 -> 0, esize<0 -> 0, n=0 -> 0 (no trap) df229x: prepared, fc=0xffffffff82607200 sizeof(fwdma_alloc_multi)=32 sizeof(fw_bulkxfer)=48 sizeof(fwdma_seg)=24 df229x/t3: FW_SSTBUF{tx: nchunk=1 npacket=1 psize=0x0} + FW_STSTREAM -> fwdev_allocbuf (fwdev.c:107-109) -> fwdma_malloc_multiseg(esize=(int)roundup2(0x0,4)) df229x/t3: firing -- baseline expectation: Fatal trap 17 (divide error) in fwdma_malloc_multiseg df229x/t3: SSTBUF err=0 df229x/t3: STSTREAM returned err=22 (reached here -> NO divide-by-zero: the fix rejected the bufspec) df229x/t1: FW_SSTBUF{tx: nchunk=1 npacket=1 psize=0x80000000} + FW_STSTREAM -> fwdev_allocbuf (fwdev.c:107-109) -> fwdma_malloc_multiseg(esize=(int)roundup2(0x80000000,4)) df229x/t1: firing -- baseline expectation: Fatal trap 17 (divide error) in fwdma_malloc_multiseg df229x/t1: SSTBUF err=0 df229x/t1: STSTREAM returned err=22 (reached here -> NO divide-by-zero: the fix rejected the bufspec) df2298b: SSTBUF{nchunk=1,npacket=0,psize=512} + STSTREAM -> err=22 d->it=0 (baseline equivalence: n==0 -> nseg==0, the same zero-length seg[] as the overflow variant) df2298: int-overflow n=nchunk*npacket -> zero-length seg[] -> OOB seg[0] read -> controlled write test df2298/a1: STSTREAM err=22 -- bufspec rejected, no zero-seg allocation (it=0 buf=0 bulkxfer=0) df2298/a2: STSTREAM err=22 -- bufspec rejected, no zero-seg allocation (it=0 buf=0 bulkxfer=0) df2298/a3: STSTREAM err=22 -- bufspec rejected, no zero-seg allocation (it=0 buf=0 bulkxfer=0) df2298: giving up after 3 attempts (status has the result) df229x: DF-2298 nchunk=npacket=0x10000: STSTREAM err=22 (rejected, no write) df229x/regression: legit {4,8,2048}: STSTREAM=0 fw_write=0 -- normal use intact df229x/guard: fwdma_malloc_multiseg(esize=0)=0 (esize=-4096)=0 (n=0)=0 -- no trap