login: HPSIM: worker: exec cmd=5
HPSIM: fake acpi_wmi bus attached: acpi_wmi39
acpi_hp0: HP event GUID detected, installing event handler
HPSIM: install_event_handler: handler=0xffffffff80a177c0 ctx=0xfffff801171cb260 (dev=acpi_hp0)
acpi_hp0: HP CMI GUID detected
HPSIM: created: acpi_wmi39 + acpi_hp0 (sc=0xfffff80117b50e80)
HPSIM: teardown: device_delete_child -> real acpi_hp_detach + newbus kfree(softc, M_BUS) [kldunload path] sc=0xfffff80117b50e80 size=1208
acpi_hp0: detached
HPSIM: victim spray: victim=0xfffff80117b50e80 old_sc=0xfffff80117b50e80 hit=1
HPSIM: control victim diff: 0 changed byte(s), 0 at known softc field(s); victim==old_sc YES
HPSIM: worker: cmd=5 DONE
HPSIM: worker: exec cmd=4
HPSIM: fake acpi_wmi bus attached: acpi_wmi40
acpi_hp0: HP event GUID detected, installing event handler
HPSIM: install_event_handler: handler=0xffffffff80a177c0 ctx=0xfffff801171cb300 (dev=acpi_hp0)
acpi_hp0: HP CMI GUID detected
HPSIM: created: acpi_wmi40 + acpi_hp0 (sc=0xfffff80117b51880)
HPSIM: dispatch: calling handler 0xffffffff80a177c0(ctx=0xfffff801171cb300) AFTER lock release
HPSIM: stall: handler parked mid-acpi_hp_notify
HPSIM: watchdog: stalled handler auto-released into (possibly freed) softc
HPSIM: uaf victim WRITE at softc+56 (field was_wlan_on_air): 0x00 -> 0x01
HPSIM: uaf victim diff: 1 changed byte(s), 1 at known softc field(s); victim==old_sc YES
HPSIM: RESULT: UAF WRITE CONFIRMED on freed softc (1 field write(s))
HPSIM: worker: cmd=4 DONE
HPSIM: worker: exec cmd=4
HPSIM: fake acpi_wmi bus attached: acpi_wmi41
acpi_hp0: HP event GUID detected, installing event handler
HPSIM: install_event_handler: handler=0xffffffff80a177c0 ctx=0xfffff801171cb3a0 (dev=acpi_hp0)
acpi_hp0: HP CMI GUID detected
HPSIM: created: acpi_wmi41 + acpi_hp0 (sc=0xfffff80117b51d80)
HPSIM: dispatch: calling handler 0xffffffff80a177c0(ctx=0xfffff801171cb3a0) AFTER lock release
HPSIM: stall: handler parked mid-acpi_hp_notify
HPSIM: watchdog: stalled handler auto-released into (possibly freed) softc
HPSIM: uaf victim WRITE at softc+56 (field was_wlan_on_air): 0x00 -> 0x01
HPSIM: uaf victim diff: 1 changed byte(s), 1 at known softc field(s); victim==old_sc YES
HPSIM: RESULT: UAF WRITE CONFIRMED on freed softc (1 field write(s))
HPSIM: worker: cmd=4 DONE
HPSIM: worker: exec cmd=4
HPSIM: fake acpi_wmi bus attached: acpi_wmi42
acpi_hp0: HP event GUID detected, installing event handler
HPSIM: install_event_handler: handler=0xffffffff80a177c0 ctx=0xfffff801171cb440 (dev=acpi_hp0)
acpi_hp0: HP CMI GUID detected
HPSIM: created: acpi_wmi42 + acpi_hp0 (sc=0xfffff80117b52280)
HPSIM: dispatch: calling handler 0xffffffff80a177c0(ctx=0xfffff801171cb440) AFTER lock release
HPSIM: stall: handler parked mid-acpi_hp_notify
HPSIM: scenario uaf: handler confirmed stalled inside acpi_hp_notify; running detach+free underneath it
HPSIM: teardown: device_delete_child -> real acpi_hp_detach + newbus kfree(softc, M_BUS) [kldunload path] sc=0xfffff80117b52280 size=1208
acpi_hp0: detached
HPSIM: victim spray: victim=0xfffff80117b52280 old_sc=0xfffff80117b52280 hit=1
HPSIM: watchdog: stalled handler auto-released into (possibly freed) softc
HPSIM: uaf victim WRITE at softc+56 (field was_wlan_on_air): 0x00 -> 0x01
HPSIM: uaf victim diff: 1 changed byte(s), 1 at known softc field(s); victim==old_sc YES
HPSIM: RESULT: UAF WRITE CONFIRMED on freed softc (1 field write(s))
HPSIM: worker: cmd=4 DONE
HPSIM: worker: exec cmd=6