# DF-2340 — run.2.log (BASELINE, run 2 of 2): identical panic, second guest
# incarnation, /usr/src PATCHED (fix.diff applied) but harness binary compiled
# in the stock order (see VERDICT.md — a `make` flag mishap made the "fixed"
# build silently compile without -DDF2340_FIXED, so this run re-executed the
# stock-ordering replay). Kept as a determinism datapoint: the panic is driven
# by the *ordering of allocation vs descriptor arrival*, not by which source
# tree the harness happens to sit on — and it reproduced bit-for-bit on a
# different boot.

Command (host):

    dfbsd-qemu/vm.sh run_root '... kldload /root/df2340/kue_poc.ko ...'

Serial console (`vm.sh log 40`) of that incarnation:

```
login: kue_poc: if_kue.c:488 with sc_desc all-zero: kmalloc(0*6) -> sc_mcfilters=0xfffffffffffffff8 (ZERO_LENGTH_PTR=0xfffffffffffffff8, NULL-guard at :490 DEAD)
kue_poc: descriptor arrived: KUE_MCFILTCNT(sc)=2 (was 0 at allocation time in the stock driver)
kue_poc: entering VERBATIM kue_setmulti() (if_kue.c:355-398): memcpy(KUE_MCFILT(sc,0)=0xfffffffffffffff8, ..., 6)


Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address	= 0xfffffffffffffff8
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff82600309
stack pointer	        = 0x10:0xfffff80118353788
frame pointer	        = 0x10:0xfffff80118353798
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1178
current thread          = pri 6 
kernel: type 12 trap, code=2

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      kue_setmulti+0x89:      movl    %edi,(%rax)
db> 
```

Same fault VA, same faulting function+offset (`kue_setmulti+0x89`), different
CPU/process/boot: deterministic.