FWOH: MEMEAT db_init RETURNED flags=1 (no failure?)
contigmalloc_map: failed size 4096 low=0 high=400000 align=4096 boundary=0 flags=00000002
FWOH: MEMEAT ate=0 freed=0 -> REAL fwohci_db_init (ch=3 ndesc=1 ndb=64)
contigmalloc_map: failed size 4096 low=0 high=400fff align=4096 boundary=0 flags=00000002
bus_dmamap_create failed
Fatal user address access from kernel mode from fwpoc at ffffffff80a7a28f


Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address	= 0x18
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff80a7a28f
stack pointer	        = 0x10:0xfffff801183915e8
frame pointer	        = 0x10:0xfffff80118391608
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 929
current thread          = pri 6 
trap number		= 12
panic: page fault
cpuid = 0
Trace beginning at frame 0xfffff801183913d8
trap_fatal() at trap_fatal+0x301 0xffffffff80bd59a1 
trap_fatal() at trap_fatal+0x301 0xffffffff80bd59a1 
trap_pfault() at trap_pfault+0x431 0xffffffff80bd5f81 
trap() at trap+0x17c 0xffffffff80bd64ec 
calltrap() at calltrap+0x9 0xffffffff80b99b1a 
--- trap 000000000000000c, rip = ffffffff80a7a28f, rsp = fffff801183915d0, rbp = fffff80118391608 ---
fwohci_db_free.part.7() at fwohci_db_free.part.7+0x4f 0xffffffff80a7a28f 
fwoctl_ioctl() at fwoctl_ioctl+0xe93 0xffffffff80a7f2e3 
boot() called on cpu#0
Uptime: 4m51s
Physical memory: 4060 MB
Dumping 558 MB: 543 527 511 495 479 463 447 431 415 399 383 367 351 335 319 303 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15
Dump complete

# ---------------------------------------------------------------------------
# Attribution:
#   "bus_dmamap_create failed"      = fwohci.c:1237, inside the REAL
#                                     fwohci_db_init loop (fwohci.c:1229)
#   fault VA 0x18                    = offsetof(struct fwohcidb_tr, dma_map)
#                                     (fwohcireg.h:330-337); db_tr == NULL,
#                                     i.e. the fwohci_db_free loop body
#                                     (fwohci.c:1168-1174) dereferenced the
#                                     NULL that STAILQ_NEXT produced because
#                                     idb(0) < dbch->ndb(64) with an empty
#                                     db_trq (K=0 partial init).
#   fwohci_db_free.part.7            = GCC parts-clone of the static
#                                     fwohci_db_free from the TU-compiled
#                                     verbatim fwohci.c (harness kernel FWO).
# Trigger history: the sub-4MB bounce window was converted page-by-page
# into permanent zone bounce pages by ~57 prior MEMEAT rounds (ate
# 128 -> 0); the final round ran with ate=0 freed=0 so the FIRST
# bus_dmamap_create of dbch->dmat failed for real (alloc_bounce_pages
# -> contigmalloc -> NULL, busdma_machdep.c:412).