# DF-2340 — run.log (BASELINE, run 1 of 2): stock /usr/src, stock ordering

Guest: DragonFly 6.5-DEVELOPMENT #0 (X86_64_GENERIC), fresh `vm.sh reset with-src`,
harness built per build.sh (`make -m /usr/src/share/mk`), which `#include`s the
VERBATIM `sys/bus/u4b/net/if_kue.c` from the stock /usr/src tree.

Command (host):

    dfbsd-qemu/vm.sh run_root 'kldload /root/df2340/kue_poc.ko; echo KLDLOAD_RC=$?'

The ssh channel died at the panic (no stdout returned; command timed out) — the
guest dropped into DDB, `vm.sh status` => down. Full serial-console transcript
(`vm.sh log 400`), also saved as panic.txt:

```
login: kue_poc: if_kue.c:488 with sc_desc all-zero: kmalloc(0*6) -> sc_mcfilters=0xfffffffffffffff8 (ZERO_LENGTH_PTR=0xfffffffffffffff8, NULL-guard at :490 DEAD)
kue_poc: descriptor arrived: KUE_MCFILTCNT(sc)=2 (was 0 at allocation time in the stock driver)
kue_poc: entering VERBATIM kue_setmulti() (if_kue.c:355-398): memcpy(KUE_MCFILT(sc,0)=0xfffffffffffffff8, ..., 6)


Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address	= 0xfffffffffffffff8
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff826001e9
stack pointer	        = 0x10:0xfffff80117df1788
frame pointer	        = 0x10:0xfffff80117df1798
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1071
current thread          = pri 10 
kernel: type 12 trap, code=2

CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      kue_setmulti+0x89:      movl    %edi,(%rax)
db> 
```

Decisive lines:

* `sc_mcfilters=0xfffffffffffffff8` — `kmalloc(0, M_USBDEV, M_WAITOK)` at
  if_kue.c:488 returned `ZERO_LENGTH_PTR` (`(void *)-8`, kern_slaballoc.c:193,
  returned by the size==0 branch at kern_slaballoc.c:885-890). The `== NULL`
  guard at if_kue.c:490 is DEAD (the harness prints `NULL-guard at :490 DEAD`).
* `Stopped at kue_setmulti+0x89: movl %edi,(%rax)` — the faulting instruction is
  INSIDE the verbatim driver function `kue_setmulti()` (the inlined first store
  of the 6-byte `memcpy(KUE_MCFILT(sc, i), LLADDR(...), ETHER_ADDR_LEN)` at
  if_kue.c:383-385), i.e. the production code, not harness code.
* `fault code = supervisor write data, page not present` at
  `0xfffffffffffffff8` — the write-through-ZERO_LENGTH_PTR exactly as claimed.