DFB-crypto[2369] ct[0..15]  = b2 c7 40 0e eb af cf e9 6d 45 aa 05 cb 24 e4 ce
DFB-crypto[2369] ct[16..31] = 40 24 d0 97 59 66 e9 ad b8 bd 17 a8 dd 8e 01 94
DFB-crypto[2369] CFB1 decrypt 2 blocks: rc=256; rt[16..31] sentinel=changed
DFB-crypto[2371] keyA(256) ct=3e0bf04cc3de861fd2eed6582d517281
DFB-crypto[2371] after set_key(len=0): k_len=4
DFB-crypto[2371] ct under len=0        =3e0bf04cc3de861fd2eed6582d517281
DFB-crypto[2371] STALE SCHEDULE PROVEN: len=0 encrypts with the PREVIOUS key's mk_tab
DFB-crypto[2371] set_key(320): k_len=4; mk_tab[0]=cafebabe (was cafebabe), mk_tab[1]=feedface (was feedface)
DFB-crypto[2363-initframe] run 0: scan directly below caller frame after _init returns: key-bytes=absent poly_key=FOUND negative=absent(ok)
DFB-crypto[2363-initframe] run 1: scan directly below caller frame after _init returns: key-bytes=absent poly_key=FOUND negative=absent(ok)
DFB-crypto[2363-initframe] run 2: scan directly below caller frame after _init returns: key-bytes=absent poly_key=FOUND negative=absent(ok)
DFB-dism[grp7null]: db_disasm(0f 01 db): db_Grp7_11[3] is NULL -> dispatch dereferences NULL+3*8 -> page fault NOW
DFB-dism[grp7null]: returned next=0xfffff8008d404583 (no fault)
DFB-dism[rexgrp7]: db_disasm(44 0f 01 c0): REX.R -> f_reg=8 -> db_Grp7_11[8] past the 6-entry table -> wild pointer NOW
DFB-dism[rexgrp7]: returned next=0xfffff8008d404584 (no fault)
DFB-dism[rexseg]: db_disasm(44 8c c0): REX.R -> db_seg_reg[8] past the 8-entry table (db_disasm.c:1381) -> wild pointer deref NOW
DFB-dism[rexseg]: returned next=0xfffff8008d404583 (no fault)
DFB-dism[control]: db_disasm(8c c0) -- expect a clean disassembly line, no fault:
DFB-dism[control]: returned next=0xfffff8008d404582 (no fault)
DFB-ehci[linear]: calling verbatim ehci_pci_take_controller()
DFB-ehci: EREAD4(off=0x8) -> 0x4000 (HCCPARAMS: EECP=0x40)
DFB-ehci[linear]: RETURNED rc=0 pci_reads=3 pci_writes=0 pause_calls=0 cfg_off_range=[0x40..0x50]
DFB-ehci[selfcycle]: calling verbatim ehci_pci_take_controller()
DFB-ehci: EREAD4(off=0x8) -> 0x5000 (HCCPARAMS: EECP=0x50)
DFB-ehci[selfcycle]: RETURNED rc=0 pci_reads=255 pci_writes=0 pause_calls=0 cfg_off_range=[0x50..0x50]
DFB-uether[mii]: fabricating mii_phy_probe-failure state
DFB-uether: if_link = {0, 0} (if_attach never ran), calling verbatim uether_ifdetach()
DFB-uether: expect if_detach() TAILQ_REMOVE through tqe_prev == NULL -> kernel panic now
DFB-uether: returned WITHOUT panic (fixed path?)
DFB-usbpf: bdev=0xfffff8008bb7f6c0 (root unit 0)
DFB-usbpf[race]: launching tapper+destroyer; if a NULL store lands between the tap's :362 check and :488 use, the kernel panics now
DFB-usbpf: tapper finished after 200000 taps (no race hit this round)
DFB-usbpf[race]: survived: taps=200000 null_stores=203709538 -- window not hit this run