DF-2360 / panic.txt
(baseline runs, DFBATCH kernels, captured from serial console)
--- grp7null: db_disasm(0f 01 db) ---
DFB-dism[grp7null]: db_disasm(0f 01 db): db_Grp7_11[3] is NULL -> dispatch dereferences NULL+3*8 -> page fault NOW
Fatal user address access from kernel mode from sysctl at ffffffff80b99909
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x18
Stopped at db_disasm+0x1049: movq (%rax,%rdx,8),%rsi
[0x18 == NULL + 3*8: db_Grp7_11[3] == NULL indexed by [3]]
--- rexgrp7: db_disasm(44 0f 01 c0) ---
DFB-dism[rexgrp7]: db_disasm(44 0f 01 c0): REX.R -> f_reg=8 -> db_Grp7_11[8] past the 6-entry table -> wild pointer NOW
Stopped at strlen: cmpb $0,(%rdi)
[db_Grp7_11[8] read past the 6-entry array yielded a garbage pointer;
db_printf("%s") -> strlen() faulted on it]
--- rexseg: db_disasm(44 8c c0) (no fault; silent corruption) ---
DFB-dism[rexseg]: returned next=... (no fault)
mov %al,%ax
[db_seg_reg[8] read past the 8-entry table returned an adjacent .rodata
pointer; the disassembly printed garbage ("mov %al,%ax" instead of
"mov %es,%eax") -- OOB read confirmed by wrong output, no fault on this
kernel's layout]