(baseline runs, DFBATCH kernels, captured from serial console) --- grp7null: db_disasm(0f 01 db) --- DFB-dism[grp7null]: db_disasm(0f 01 db): db_Grp7_11[3] is NULL -> dispatch dereferences NULL+3*8 -> page fault NOW Fatal user address access from kernel mode from sysctl at ffffffff80b99909 Fatal trap 12: page fault while in kernel mode fault virtual address = 0x18 Stopped at db_disasm+0x1049: movq (%rax,%rdx,8),%rsi [0x18 == NULL + 3*8: db_Grp7_11[3] == NULL indexed by [3]] --- rexgrp7: db_disasm(44 0f 01 c0) --- DFB-dism[rexgrp7]: db_disasm(44 0f 01 c0): REX.R -> f_reg=8 -> db_Grp7_11[8] past the 6-entry table -> wild pointer NOW Stopped at strlen: cmpb $0,(%rdi) [db_Grp7_11[8] read past the 6-entry array yielded a garbage pointer; db_printf("%s") -> strlen() faulted on it] --- rexseg: db_disasm(44 8c c0) (no fault; silent corruption) --- DFB-dism[rexseg]: returned next=... (no fault) mov %al,%ax [db_seg_reg[8] read past the 8-entry table returned an adjacent .rodata pointer; the disassembly printed garbage ("mov %al,%ax" instead of "mov %es,%eax") -- OOB read confirmed by wrong output, no fault on this kernel's layout]