# DF-2344 run log -- verbatim excerpts from the shared UMCSH rig (see ../DF-2343/)
# Baseline: run1_baseline.sh, STOCK-codegen (-O2) harness kernel, 2026-10-18 21:28 UTC
# ctl output fields: rc=attach() return, numports=sc_numports after attach.

=== BASELINE 1/2: sanity -- GPIO read SUCCEEDS (device answers) ===
 [script: ./umcshctl 4 0x01 0   -> sim GPIO reg 0x07 returns 0x01]
  rc=0 numports=4 divisor=0 clk=0x00 attached=0 rd=2 wr=0 oob_dword=0x00000000
  msg: attached, tty=ucom0
 [script: ./umcshctl 5 ; ./umcshctl 4 0x00 0 -> sim GPIO returns 0x00]
  rc=0 numports=2 divisor=0 clk=0x00 attached=0 rd=2 wr=0 oob_dword=0x00000000
  msg: attached, tty=ucom0

=== BASELINE 2/2: GPIO control transfer FAILS + stack groomed below the frame ===
 [script order: poison 0xA5(bit0=1), 0x00(bit0=0), 0x01(bit0=1), 0x42(bit0=0);
  each followed by ./umcshctl 5 detach.  umcs.c:324 discards the read error;
  the byte at the uninitialized 'data' slot (address taken => stack) is the
  groom byte; the decision at umcs.c:325 follows it, NOT the device.]
  rc=0 numports=4 divisor=0 clk=0x00 attached=0 rd=2 wr=0 oob_dword=0x00000000
  msg: attached, tty=ucom0
  rc=0 numports=2 divisor=0 clk=0x00 attached=0 rd=2 wr=0 oob_dword=0x00000000
  msg: attached, tty=ucom0
  rc=0 numports=4 divisor=0 clk=0x00 attached=0 rd=2 wr=0 oob_dword=0x00000000
  msg: attached, tty=ucom0
  rc=0 numports=2 divisor=0 clk=0x00 attached=0 rd=2 wr=0 oob_dword=0x00000000
  msg: attached, tty=ucom0

RESULT: groom 0xA5 -> 4 ports ; 0x00 -> 2 ; 0x01 -> 4 ; 0x42 -> 2.
sc_numports followed the stack poison on 4/4 runs; attach SUCCEEDED each
time with the garbage-derived port count (ttyU0.0-3 or .0-.1 created).

=== FIXED KERNEL (both umcs.c fixes applied, -O0 semantics; run3_fixed.sh) ===
 [script: ./umcshctl 4 0xA5 3 ; 4 0x00 3 ; 4 0x01 3 ; 4 0x42 3 ; 7]
=== DF-2343/DF-2344 fixed-kernel A/B (-O0 semantics) ===
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #4: Sun Oct 18 22:16:42 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/UMCSH  x86_64
1064:	if (rate == 0)		/* no div-by-zero, no divisors[9] OOB read */
325:		device_printf(dev, "failed to read GPIO register\n");
--- DF-2343 fixed: rate==0 now rejected before the loop ---
  rc=0 numports=0 divisor=0 clk=0x00 attached=0 rd=0 wr=0 oob_dword=0x00000000
  rc=4294967295 numports=0 divisor=57005 clk=0xee attached=0 rd=0 wr=0 oob_dword=0x00000000
  rc=0 numports=0 divisor=12 clk=0x00 attached=0 rd=0 wr=0 oob_dword=0x00000000
  rc=22 numports=0 divisor=0 clk=0x00 attached=0 rd=0 wr=0 oob_dword=0x00000000
  rc=22 numports=0 divisor=0 clk=0x00 attached=0 rd=0 wr=0 oob_dword=0x00000000
--- DF-2344 fixed: GPIO failure -> deterministic ENXIO ---
  rc=6 numports=0 divisor=0 clk=0x00 attached=0 rd=1 wr=0 oob_dword=0x00000000
  rc=6 numports=0 divisor=0 clk=0x00 attached=0 rd=1 wr=0 oob_dword=0x00000000
  rc=6 numports=0 divisor=0 clk=0x00 attached=0 rd=1 wr=0 oob_dword=0x00000000
  rc=6 numports=0 divisor=0 clk=0x00 attached=0 rd=1 wr=0 oob_dword=0x00000000
  rc=0 numports=0 divisor=0 clk=0x00 attached=0 rd=1 wr=0 oob_dword=0x00000000
  msg: attached=0 numports=0
--- DF-2344 no-regression: good device still attaches ---

=== FIXED: no regression -- good device still attaches (4 ports) ===
  rc=0 numports=4 divisor=0 clk=0x00 attached=0 rd=2 wr=0 oob_dword=0x00000000
  msg: attached, tty=ucom0
  rc=16 numports=0 divisor=0 clk=0x00 attached=0 rd=0 wr=0 oob_dword=0x00000000
  msg: already attached, run DETACH first
  rc=0 numports=0 divisor=0 clk=0x00 attached=0 rd=0 wr=0 oob_dword=0x00000000

RESULT: GPIO read failure -> deterministic rc=6 (ENXIO) for every poison byte;
numports stays 0, attach never completes from garbage. Good device: 4 ports.