DF-2316 / run.log
================================================================================
DF-2316 BASELINE RUN LOG (kernel: PNPH = X86_64_GENERIC + pnp_harness, with the
VERBATIM sys/bus/isa/pnpparse.c TU-compiled into the harness; prep.sh sha256 gate
4b13638c30fcb3cfae135711d2e4275f500edfc0cb3d35857e777399b25696a3 = pristine
audit-tree pnpparse.c).
================================================================================
--- PART 1: userland scenario driver (run.sh, scenarios 9,20,21,22,23x3,24,26)
=== DF-2316 baseline ===
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #2: Sun Oct 18 17:09:41 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/PNPH x86_64
SC 9 arg=0: rc=0 tag= declared=0 need=0 attrib=0 pass=0 nfields=0 child=
SC 20 arg=0: rc=0 tag=MEM32_RANGE declared=0 need=17 attrib=16 pass=1 nfields=5 child=
fields: [0]=0x1/0x1 [1]=0x5040302/0x5040302 [2]=0xe0c0a07/0xe0c0a07 [3]=0x9080706/0x9080706 [4]=0x1/0x1
SC 21 arg=0: rc=0 tag= declared=0 need=0 attrib=0 pass=1 nfields=5 child=
fields: [0]=0x1/0x1 [1]=0x445d5c5b/0x445d5c5b [2]=0x528c8486/0x528c8486 [3]=0x21595241/0x21595241 [4]=0x4e414336/0x4e414336
chunk1=fffff801175a2200 chunk2=fffff801175a2400 wrote=0
leakraw: 00000044 00000046 00000032 00000033 00000031 00000036 00000043 00000041
SC 22 arg=0: rc=0 tag= declared=0 need=0 attrib=0 pass=0 nfields=0 child=
chunk1=fffff80089797000 chunk2=fffff80089797200 wrote=1
canary before: cc cc 00 7f cc cc cc cc after: cc cc 01 7f cc cc cc cc
SC 23 arg=1: rc=0 tag= declared=0 need=0 attrib=0 pass=1 nfields=0 child=(null)
leakraw: 00000011 00000013 00000015 00000017 00000019 0000001b 0000001d 0000001f
SC 23 arg=2: rc=0 tag= declared=0 need=0 attrib=0 pass=1 nfields=0 child=(null)
chunk1=fffff8008db3a000 chunk2=fffff8008db3a400 wrote=0
leakraw: 00000044 00000032 00000031 00000043 0000004e 00000052 00000021 00000046
SC 23 arg=3: rc=0 tag= declared=0 need=0 attrib=0 pass=1 nfields=0 child=(null)
leakraw: 000000ff 000000ff 000000ff 00000053 00000044 00000045 00000048 00000041
SC 24 arg=0: rc=0 tag= declared=0 need=0 attrib=0 pass=1 nfields=27 child=(null)
fields: [0]=0x44332211/0 [1]=0x1/0 [2]=0xcdef/0 [3]=0x1/0 [4]=0x3b/0 [5]=0x2/0 [6]=0x220/0 [7]=0x23f/0
SC 26 arg=0: rc=0 tag= declared=17 need=0 attrib=0 pass=1 nfields=0 child=
=== dmesg (kernel-side lines) ===
PNPH sweep f[3]= 0x3 expect= 0x3
PNPH sweep f[4]= 0x1 expect= 0x1
PNPH sweep MEM_RANGE declen=0 need=9: TRUNCATED -- 9 bytes read past a len-0 descriptor (offsets 0..8) attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x30200 expect= 0x30200
PNPH sweep f[2]= 0xe0bff expect= 0xe0bff
PNPH sweep f[3]= 0x90800 expect= 0x90800
PNPH sweep f[4]= 0x706 expect= 0x706
PNPH sweep MEM_RANGE declen=9 need=9: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x30200 expect= 0x30200
PNPH sweep f[2]= 0xe0bff expect= 0xe0bff
PNPH sweep f[3]= 0x90800 expect= 0x90800
PNPH sweep f[4]= 0x706 expect= 0x706
PNPH sweep MEM32_RANGE declen=0 need=17: TRUNCATED -- 17 bytes read past a len-0 descriptor (offsets 0..16) attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x5040302 expect= 0x5040302
PNPH sweep f[2]=0x1a181613 expect=0x1a181613
PNPH sweep f[3]=0x11100f0e expect=0x11100f0e
PNPH sweep f[4]= 0xd0c0b0a expect= 0xd0c0b0a
PNPH sweep MEM32_RANGE declen=17 need=17: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x5040302 expect= 0x5040302
PNPH sweep f[2]=0x1a181613 expect=0x1a181613
PNPH sweep f[3]=0x11100f0e expect=0x11100f0e
PNPH sweep f[4]= 0xd0c0b0a expect= 0xd0c0b0a
PNPH sweep MEM32_FIXED declen=0 need=9: TRUNCATED -- 9 bytes read past a len-0 descriptor (offsets 0..8) attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x5040302 expect= 0x5040302
PNPH sweep f[2]= 0xe0c0a07 expect= 0xe0c0a07
PNPH sweep f[3]= 0x9080706 expect= 0x9080706
PNPH sweep f[4]= 0x1 expect= 0x1
PNPH sweep MEM32_FIXED declen=9 need=9: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x5040302 expect= 0x5040302
PNPH sweep f[2]= 0xe0c0a07 expect= 0xe0c0a07
PNPH sweep f[3]= 0x9080706 expect= 0x9080706
PNPH sweep f[4]= 0x1 expect= 0x1
PNPH sweep MEM32_RANGE declen=16 need=17: 1 byte (offset +16) past the descriptor attrib=PASS
PNPH sweep: worst case = 17 bytes (MEMORY32_RANGE, pnpparse.c:278-299)
PNPH canrd[0]: c1=0xfffff801175a2200 c2=0xfffff801175a2400 res=0xfffff801175a23fc res+13=0xfffff801175a2409 (c2+9)
PNPH canrd[0]: ir_size=0x21595241 == I32(c2+9)=0x21595241 ir_align=0x4e414336 == I32(c2+5)=0x4e414336 -> read 13 bytes past the 512B chunk (canary text leak)
PNPH canrd f[0]= 0x1 expect= 0x1
PNPH canrd f[1]=0x445d5c5b expect=0x445d5c5b
PNPH canrd f[2]=0x528c8486 expect=0x528c8486
PNPH canrd f[3]=0x21595241 expect=0x21595241
PNPH canrd f[4]=0x4e414336 expect=0x4e414336
PNPH canrd[1]: c1=0xfffff801175a5200 c2=0xfffff801175a5400 res=0xfffff801175a53fc res+13=0xfffff801175a5409 (c2+9)
PNPH canrd[1]: ir_size=0x21595241 == I32(c2+9)=0x21595241 ir_align=0x4e414336 == I32(c2+5)=0x4e414336 -> read 13 bytes past the 512B chunk (canary text leak)
PNPH canrd f[0]= 0x1 expect= 0x1
PNPH canrd f[1]=0x445d5c5b expect=0x445d5c5b
PNPH canrd f[2]=0x528c8486 expect=0x528c8486
PNPH canrd f[3]=0x21595241 expect=0x21595241
PNPH canrd f[4]=0x4e414336 expect=0x4e414336
PNPH canrd[2]: c1=0xfffff801175a8200 c2=0xfffff801175a8400 res=0xfffff801175a83fc res+13=0xfffff801175a8409 (c2+9)
PNPH canrd[2]: ir_size=0x21595241 == I32(c2+9)=0x21595241 ir_align=0x4e414336 == I32(c2+5)=0x4e414336 -> read 13 bytes past the 512B chunk (canary text leak)
PNPH canrd f[0]= 0x1 expect= 0x1
PNPH canrd f[1]=0x445d5c5b expect=0x445d5c5b
PNPH canrd f[2]=0x528c8486 expect=0x528c8486
PNPH canrd f[3]=0x21595241 expect=0x21595241
PNPH canrd f[4]=0x4e414336 expect=0x4e414336
PNPH canwr: c1=0xfffff80089797000 c2=0xfffff80089797200 res=0xfffff800897971fd res+5=0xfffff80089797202 (c2+2) res+6=0xfffff80089797203 (c2+3)
PNPH canwr: c2[0..7] before: cc cc 00 7f cc cc cc cc
PNPH canwr: c2[0..7] after: cc cc 01 7f cc cc cc cc
PNPH canwr: canary byte c2[2] (res+5, 2 bytes past the chunk) 0x00 -> 0x1 : OOB WRITE PROVEN (pnpparse.c:163-166 res[5]=1)
PNPH e2e1: buf=0xfffff8008db3d000 logical len=3, payload markers at [3..1024)
PNPH e2e1: stored config:
PNPH e2e1: nmem=1 nport=0 nirq=0 ndrq=0
PNPH e2e1: mem[0] start=0x8070605 end=0x201e1c19 size=0x14131211 align=0x100f0e0d
PNPH e2e1: ir_size=0x14131211 == I32(buf+16)=0x14131211 (markers past the logical stream end)
PNPH e2e2: c1=0xfffff8008db3a000 c2=0xfffff8008db3a400; tag+len bytes at c1[1021..1023], res=c1+1024=c2 -> reads c2[0..16], ALL past the 1024B allocation
PNPH e2e2: stored config:
PNPH e2e2: nmem=1 nport=0 nirq=0 ndrq=0
PNPH e2e2: mem[0] start=0x31333246 end=0x81738979 size=0x33324644 align=0x21595241
PNPH e2e2: ir_size=0x33324644 == I32(c2+13)=0x33324644 -> 17 canary bytes read past the allocation through the REAL parse entry
PNPH e2e3: groom=0xfffff8008db35800 stream=0xfffff8008db35800 same=1 (uninitialized heap residue visible past the descriptor)
PNPH e2e3: residue bytes st[3..19]: ff ff ff ff ff 45 53 49 44 55 45 2d 48 45 41 50 44 <.....ESIDUE-HEAPD>
PNPH e2e3: stored config:
PNPH e2e3: nmem=1 nport=0 nirq=0 ndrq=0
PNPH e2e3: mem[0] start=0xffffffff end=0x88999489 size=0x44504145 align=0x482d4555
PNPH e2e3: ir_size=0x44504145 == I32(st+16)=0x44504145 -> kernel heap residue flowed into the device resource config (devinfo/bootverbose visible)
PNPH well: child=(null) compatid=0x44332211 have=1 nmem=3 nport=2 nirq=1 ndrq=1
PNPH well: nmem=3 nport=2 nirq=1 ndrq=1
PNPH well: mem[0] start=0x100000 end=0x20ffff size=0x10000 align=0x1000
PNPH well: mem[1] start=0x10000000 end=0x2fffffff size=0x10000000 align=0x4000000
PNPH well: mem[2] start=0x20000000 end=0x2fffffff size=0x10000000 align=0x1
PNPH well: port[0] start=0x220 end=0x23f size=0x10 align=0x10
PNPH well: port[1] start=0x2f8 end=0x2ff size=0x8 align=0x1
PNPH well: irq[0]=0xcdef
PNPH well: drq[0]=0x3b
PNPH well: field vector (A/B reference):
PNPH well field[ 0]=0x44332211
PNPH well field[ 1]= 0x1
PNPH well field[ 2]= 0xcdef
PNPH well field[ 3]= 0x1
PNPH well field[ 4]= 0x3b
PNPH well field[ 5]= 0x2
PNPH well field[ 6]= 0x220
PNPH well field[ 7]= 0x23f
PNPH well field[ 8]= 0x10
PNPH well field[ 9]= 0x10
PNPH well field[10]= 0x2f8
PNPH well field[11]= 0x2ff
PNPH well field[12]= 0x8
PNPH well field[13]= 0x1
PNPH well field[14]= 0x3
PNPH well field[15]= 0x100000
PNPH well field[16]= 0x20ffff
PNPH well field[17]= 0x10000
PNPH well field[18]= 0x1000
PNPH well field[19]=0x10000000
PNPH well field[20]=0x2fffffff
PNPH well field[21]=0x10000000
PNPH well field[22]= 0x4000000
PNPH well field[23]=0x20000000
PNPH well field[24]=0x2fffffff
PNPH well field[25]=0x10000000
PNPH well field[26]= 0x1
PNPH pg: base=0xfffff8011834e000 page2=0xfffff8011834f000 res=0xfffff8011834efef res+13=0xfffff8011834effc page1end=0xfffff8011834f000
PNPH pgctl: full len-17 descriptor parsed rc=0 nmem=1 ir_size=0x11100f0e==I32(res+13)=0x11100f0e attrib=PASS (all reads inside page 1)
=== DF-2316 baseline done ===
--- PART 2: kernel-side console lines for the same runs (serial console)
debug.debugger_on_panic: 1 -> 0
login: PNPH layout: sizeof(isa_config)=960 ic_mem=0 ic_port=128 ic_irqmask=928 ic_drqmask=936 ic_nmem=944
PNPH layout: fixed-offset handlers (tag, bytes dereferenced): COMPAT 4 @0, IRQ 2 @0, DMA 1 @0, IO_RANGE 7 @1..6, IO_FIXED 3 @0..2, MEM_RANGE 9 @1..8, MEM32_RANGE 17 @1..16, MEM32_FIXED 9 @1..8
PNPH sweep COMPAT_DEVICE declen=0 need=4: TRUNCATED -- 4 bytes read past a len-0 descriptor (offsets 0..3) attrib=PASS
PNPH sweep f[0]= 0x4030201 expect= 0x4030201
PNPH sweep COMPAT_DEVICE declen=4 need=4: control attrib=PASS
PNPH sweep f[0]= 0x4030201 expect= 0x4030201
PNPH sweep IRQ_FORMAT declen=0 need=2: TRUNCATED -- 2 bytes read past a len-0 descriptor (offsets 0..1) attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x201 expect= 0x201
PNPH sweep IRQ_FORMAT declen=2 need=2: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x201 expect= 0x201
PNPH sweep DMA_FORMAT declen=0 need=1: TRUNCATED -- 1 bytes read past a len-0 descriptor (offsets 0..0) attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x1 expect= 0x1
PNPH sweep DMA_FORMAT declen=1 need=1: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x1 expect= 0x1
PNPH sweep IO_RANGE declen=0 need=7: TRUNCATED -- 7 bytes read past a len-0 descriptor (offsets 0..6) attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x302 expect= 0x302
PNPH sweep f[2]= 0x50a expect= 0x50a
PNPH sweep f[3]= 0x7 expect= 0x7
PNPH sweep f[4]= 0x6 expect= 0x6
PNPH sweep IO_RANGE declen=7 need=7: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x302 expect= 0x302
PNPH sweep f[2]= 0x50a expect= 0x50a
PNPH sweep f[3]= 0x7 expect= 0x7
PNPH sweep f[4]= 0x6 expect= 0x6
PNPH sweep IO_FIXED declen=0 need=3: TRUNCATED -- 3 bytes read past a len-0 descriptor (offsets 0..2) attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x201 expect= 0x201
PNPH sweep f[2]= 0x203 expect= 0x203
PNPH sweep f[3]= 0x3 expect= 0x3
PNPH sweep f[4]= 0x1 expect= 0x1
PNPH sweep IO_FIXED declen=3 need=3: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x201 expect= 0x201
PNPH sweep f[2]= 0x203 expect= 0x203
PNPH sweep f[3]= 0x3 expect= 0x3
PNPH sweep f[4]= 0x1 expect= 0x1
PNPH sweep MEM_RANGE declen=0 need=9: TRUNCATED -- 9 bytes read past a len-0 descriptor (offsets 0..8) attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x30200 expect= 0x30200
PNPH sweep f[2]= 0xe0bff expect= 0xe0bff
PNPH sweep f[3]= 0x90800 expect= 0x90800
PNPH sweep f[4]= 0x706 expect= 0x706
PNPH sweep MEM_RANGE declen=9 need=9: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x30200 expect= 0x30200
PNPH sweep f[2]= 0xe0bff expect= 0xe0bff
PNPH sweep f[3]= 0x90800 expect= 0x90800
PNPH sweep f[4]= 0x706 expect= 0x706
PNPH sweep MEM32_RANGE declen=0 need=17: TRUNCATED -- 17 bytes read past a len-0 descriptor (offsets 0..16) attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x5040302 expect= 0x5040302
PNPH sweep f[2]=0x1a181613 expect=0x1a181613
PNPH sweep f[3]=0x11100f0e expect=0x11100f0e
PNPH sweep f[4]= 0xd0c0b0a expect= 0xd0c0b0a
PNPH sweep MEM32_RANGE declen=17 need=17: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x5040302 expect= 0x5040302
PNPH sweep f[2]=0x1a181613 expect=0x1a181613
PNPH sweep f[3]=0x11100f0e expect=0x11100f0e
PNPH sweep f[4]= 0xd0c0b0a expect= 0xd0c0b0a
PNPH sweep MEM32_FIXED declen=0 need=9: TRUNCATED -- 9 bytes read past a len-0 descriptor (offsets 0..8) attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x5040302 expect= 0x5040302
PNPH sweep f[2]= 0xe0c0a07 expect= 0xe0c0a07
PNPH sweep f[3]= 0x9080706 expect= 0x9080706
PNPH sweep f[4]= 0x1 expect= 0x1
PNPH sweep MEM32_FIXED declen=9 need=9: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x5040302 expect= 0x5040302
PNPH sweep f[2]= 0xe0c0a07 expect= 0xe0c0a07
PNPH sweep f[3]= 0x9080706 expect= 0x9080706
PNPH sweep f[4]= 0x1 expect= 0x1
PNPH sweep MEM32_RANGE declen=16 need=17: 1 byte (offset +16) past the descriptor attrib=PASS
PNPH sweep: worst case = 17 bytes (MEMORY32_RANGE, pnpparse.c:278-299)
PNPH canrd[0]: c1=0xfffff801175a2200 c2=0xfffff801175a2400 res=0xfffff801175a23fc res+13=0xfffff801175a2409 (c2+9)
PNPH canrd[0]: ir_size=0x21595241 == I32(c2+9)=0x21595241 ir_align=0x4e414336 == I32(c2+5)=0x4e414336 -> read 13 bytes past the 512B chunk (canary text leak)
PNPH canrd f[0]= 0x1 expect= 0x1
PNPH canrd f[1]=0x445d5c5b expect=0x445d5c5b
PNPH canrd f[2]=0x528c8486 expect=0x528c8486
PNPH canrd f[3]=0x21595241 expect=0x21595241
PNPH canrd f[4]=0x4e414336 expect=0x4e414336
PNPH canrd[1]: c1=0xfffff801175a5200 c2=0xfffff801175a5400 res=0xfffff801175a53fc res+13=0xfffff801175a5409 (c2+9)
PNPH canrd[1]: ir_size=0x21595241 == I32(c2+9)=0x21595241 ir_align=0x4e414336 == I32(c2+5)=0x4e414336 -> read 13 bytes past the 512B chunk (canary text leak)
PNPH canrd f[0]= 0x1 expect= 0x1
PNPH canrd f[1]=0x445d5c5b expect=0x445d5c5b
PNPH canrd f[2]=0x528c8486 expect=0x528c8486
PNPH canrd f[3]=0x21595241 expect=0x21595241
PNPH canrd f[4]=0x4e414336 expect=0x4e414336
PNPH canrd[2]: c1=0xfffff801175a8200 c2=0xfffff801175a8400 res=0xfffff801175a83fc res+13=0xfffff801175a8409 (c2+9)
PNPH canrd[2]: ir_size=0x21595241 == I32(c2+9)=0x21595241 ir_align=0x4e414336 == I32(c2+5)=0x4e414336 -> read 13 bytes past the 512B chunk (canary text leak)
PNPH canrd f[0]= 0x1 expect= 0x1
PNPH canrd f[1]=0x445d5c5b expect=0x445d5c5b
PNPH canrd f[2]=0x528c8486 expect=0x528c8486
PNPH canrd f[3]=0x21595241 expect=0x21595241
PNPH canrd f[4]=0x4e414336 expect=0x4e414336
PNPH canwr: c1=0xfffff80089797000 c2=0xfffff80089797200 res=0xfffff800897971fd res+5=0xfffff80089797202 (c2+2) res+6=0xfffff80089797203 (c2+3)
PNPH canwr: c2[0..7] before: cc cc 00 7f cc cc cc cc
PNPH canwr: c2[0..7] after: cc cc 01 7f cc cc cc cc
PNPH canwr: canary byte c2[2] (res+5, 2 bytes past the chunk) 0x00 -> 0x1 : OOB WRITE PROVEN (pnpparse.c:163-166 res[5]=1)
PNPH e2e1: buf=0xfffff8008db3d000 logical len=3, payload markers at [3..1024)
PNPH e2e1: stored config:
PNPH e2e1: nmem=1 nport=0 nirq=0 ndrq=0
PNPH e2e1: mem[0] start=0x8070605 end=0x201e1c19 size=0x14131211 align=0x100f0e0d
PNPH e2e1: ir_size=0x14131211 == I32(buf+16)=0x14131211 (markers past the logical stream end)
PNPH e2e2: c1=0xfffff8008db3a000 c2=0xfffff8008db3a400; tag+len bytes at c1[1021..1023], res=c1+1024=c2 -> reads c2[0..16], ALL past the 1024B allocation
PNPH e2e2: stored config:
PNPH e2e2: nmem=1 nport=0 nirq=0 ndrq=0
PNPH e2e2: mem[0] start=0x31333246 end=0x81738979 size=0x33324644 align=0x21595241
PNPH e2e2: ir_size=0x33324644 == I32(c2+13)=0x33324644 -> 17 canary bytes read past the allocation through the REAL parse entry
PNPH e2e3: groom=0xfffff8008db35800 stream=0xfffff8008db35800 same=1 (uninitialized heap residue visible past the descriptor)
PNPH e2e3: residue bytes st[3..19]: ff ff ff ff ff 45 53 49 44 55 45 2d 48 45 41 50 44 <.....ESIDUE-HEAPD>
PNPH e2e3: stored config:
PNPH e2e3: nmem=1 nport=0 nirq=0 ndrq=0
PNPH e2e3: mem[0] start=0xffffffff end=0x88999489 size=0x44504145 align=0x482d4555
PNPH e2e3: ir_size=0x44504145 == I32(st+16)=0x44504145 -> kernel heap residue flowed into the device resource config (devinfo/bootverbose visible)
PNPH well: child=(null) compatid=0x44332211 have=1 nmem=3 nport=2 nirq=1 ndrq=1
PNPH well: nmem=3 nport=2 nirq=1 ndrq=1
PNPH well: mem[0] start=0x100000 end=0x20ffff size=0x10000 align=0x1000
PNPH well: mem[1] start=0x10000000 end=0x2fffffff size=0x10000000 align=0x4000000
PNPH well: mem[2] start=0x20000000 end=0x2fffffff size=0x10000000 align=0x1
PNPH well: port[0] start=0x220 end=0x23f size=0x10 align=0x10
PNPH well: port[1] start=0x2f8 end=0x2ff size=0x8 align=0x1
PNPH well: irq[0]=0xcdef
PNPH well: drq[0]=0x3b
PNPH well: field vector (A/B reference):
PNPH well field[ 0]=0x44332211
PNPH well field[ 1]= 0x1
PNPH well field[ 2]= 0xcdef
PNPH well field[ 3]= 0x1
PNPH well field[ 4]= 0x3b
PNPH well field[ 5]= 0x2
PNPH well field[ 6]= 0x220
PNPH well field[ 7]= 0x23f
PNPH well field[ 8]= 0x10
PNPH well field[ 9]= 0x10
PNPH well field[10]= 0x2f8
PNPH well field[11]= 0x2ff
PNPH well field[12]= 0x8
PNPH well field[13]= 0x1
PNPH well field[14]= 0x3
PNPH well field[15]= 0x100000
PNPH well field[16]= 0x20ffff
PNPH well field[17]= 0x10000
PNPH well field[18]= 0x1000
PNPH well field[19]=0x10000000
PNPH well field[20]=0x2fffffff
PNPH well field[21]=0x10000000
PNPH well field[22]= 0x4000000
PNPH well field[23]=0x20000000
PNPH well field[24]=0x2fffffff
PNPH well field[25]=0x10000000
PNPH well field[26]= 0x1
PNPH pg: base=0xfffff8011834e000 page2=0xfffff8011834f000 res=0xfffff8011834efef res+13=0xfffff8011834effc page1end=0xfffff8011834f000
PNPH pgctl: full len-17 descriptor parsed rc=0 nmem=1 ir_size=0x11100f0e==I32(res+13)=0x11100f0e attrib=PASS (all reads inside page 1)
PNPH pg: base=0xfffff801184b0000 page2=0xfffff801184b1000 res=0xfffff801184b0ff3 res+13=0xfffff801184b1000 page1end=0xfffff801184b1000
PNPH pgflt: page2 PTE removed; calling pnp_parse_desc(tag=0x85 MEMORY32_RANGE, res, len=0) -- expect fatal page fault at va=0xfffff801184b1000 (= res+13, first OOB byte)
PNPH pgflt: UNEXPECTED no-fault rc=0 (fixed kernel?)
root@dfbsd:/usr/obj/usr/src/sys/PNPH
--- PART 3: page-boundary fault scenario 25 on the same baseline kernel
--- (separate boot of the identical kernel build; guest panicked, ssh died)
SC 25 arg=0: rc=0 tag= declared=0 need=0 attrib=0 pass=0 nfields=0 child=
--- PART 4: the resulting panic (full text in panic.txt)
Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address = 0xfffff80118371003
fault code = supervisor read data, page not present
instruction pointer = 0x8:0xffffffff80a7faa5
stack pointer = 0x10:0xfffff80117aaaf98
frame pointer = 0x10:0xfffff80117aab048
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 826
current thread = pri 6
trap number = 12
panic: page fault
cpuid = 2
Trace beginning at frame 0xfffff80117aaad88
trap_fatal() at trap_fatal+0x301 0xffffffff80bd7411
trap_fatal() at trap_fatal+0x301 0xffffffff80bd7411
trap_pfault() at trap_pfault+0x475 0xffffffff80bd7a35
trap() at trap+0x17c 0xffffffff80bd7f5c
calltrap() at calltrap+0x9 0xffffffff80b9b58a
--- trap 000000000000000c, rip = ffffffff80a7faa5, rsp = fffff80117aaaf80, rbp = fffff80117aab048 ---
pnp_parse_desc() at pnp_parse_desc+0x685 0xffffffff80a7faa5
run_pagebound() at run_pagebound+0x204 0xffffffff80a802a4
boot() called on cpu#2
Uptime: 53s
Physical memory: 4060 MB
Dumping 551 MB: 536 520 504 488 472 456 440 424 408 392 376 360 344 328 312 296 280 264 248 232 216 200 184 168 152 136 120 104 88 72 56 40 24 8
Dump complete