DF-2427 / run_fixed_dmesg.log
acd0: DVDROM <QEMU DVD-ROM/2.5+> at ata1-master WDMA2
pci0: <bridge> (vendor 0x8086, dev 0x7113) at device 1.3 irq 9
vgapci0: <VGA-compatible display> mem 0xfebd0000-0xfebd0fff,0xfd000000-0xfdffffff at device 2.0 on pci0
vgapci0: Boot video device
virtio_pci0: <VirtIO PCI Network adapter> port 0xc080-0xc09f mem 0xfe000000-0xfe003fff,0xfebd1000-0xfebd1fff irq 11 at device 3.0 on pci0
vtnet0: <VirtIO Networking Adapter> on virtio_pci0
virtio_pci0: host features: 0x79bf8064 <EventIdx,RingIndirect,AnyLayout,NotifyOnEmpty,SetMacAddress,GuestAnnounce,RxModeExtra,VLanFilter,RxMode,ControlVq,Status,MrgRxBuf,TxAllGSO,MacAddress,DynOffload>
virtio_pci0: negotiated features: 0x198f8020 <RingIndirect,AnyLayout,NotifyOnEmpty,SetMacAddress,VLanFilter,RxMode,ControlVq,Status,MrgRxBuf,MacAddress>
virtio_pci0: using 3 MSI-X vectors
vtnet0: MAC address: 52:54:00:12:34:56
virtio_pci1: <VirtIO PCI Block adapter> port 0xc000-0xc07f mem 0xfe004000-0xfe007fff,0xfebd2000-0xfebd2fff irq 11 at device 4.0 on pci0
vtblk0: <VirtIO Block Adapter> on virtio_pci1
virtio_pci1: host features: 0x79007e54 <EventIdx,RingIndirect,AnyLayout,NotifyOnEmpty,WriteZeroes,Discard,MultiQueue,ConfigWCE,Topology,FlushCommand,BlockSize,DiskGeometry,MaxNumSegs>
virtio_pci1: negotiated features: 0x10001a54 <RingIndirect,MultiQueue,ConfigWCE,FlushCommand,BlockSize,DiskGeometry,MaxNumSegs>
virtio_pci1: using 6 MSI-X vectors
vtblk0: Virtio: ncylinders at legacy maximum (16383), recalculating to 62415
vtblk0: Block size: 512
vtblk0: 30720MB (62914560 512 byte sectors: 16H 63S/T 16383C)
atkbdc0: <Keyboard controller (i8042)> port 0x64,0x60 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
psm0: <PS/2 Mouse> irq 12 on atkbdc0
interrupt uses mplock: psm0
psm0: model IntelliMouse Explorer, device ID 4
sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 on acpi0
sio0: type 16550A, console
ACPI: Enabled 2 GPEs in block 00 to 0F
rdrand0: No RdRand support.
orm0: <ISA Option ROM> at iomem 0xe8000-0xeffff on isa1
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa1
sio2: can't drain, serial port might not exist, disabling
hpt27xx: no controller detected.
CAM: Configuring 2 busses
CAM: finished configuring all busses
cd0 at ata1 bus 0 target 0 lun 0
cd0: <QEMU QEMU DVD-ROM 2.5+> Removable CD-ROM SCSI-0 device
cd0: 16.000MB/s transfers
cd0: Attempt to query device size failed: NOT READY, Medium not present
Mounting root from hammer2:vbd0s1d
hammer2_mount: root devstr="vbd0s1d"
hammer2_mount: device="vbd0s1d" label="ROOT" rdonly=1
hammer2_ondisk: "/dev/vbd0s1d" zone=1 id=0 offset=0x0000000000000000 size=0x000000063f000000
hammer2_mount: hmp=0xfffff8008fac0000 pmp=0xfffff80090260000
DMA space used: 13580k, remaining available: 131072k
Mounting devfs
hammer2_mount: "vbd0s1d": no recovery needed
hammer2: enable read/write
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
swap low/high-water marks set to 41940/62910
DFH: ########## DF-2426 control BEGIN ##########
DFH: ==== DF-2426 control: block_size = 512 ====
DFH: ---- XPT_CALC_GEOMETRY block_size=512 volume_size=204800 (expecting sane geometry) ----
DFH: RESULT amd_action returned, xpt_done=1 status=0x01 heads=64 secs=32 cylinders=100
DFH: PASS: nonzero block_size computes 64/32/100 geometry, CAM_REQ_CMP
DFH: ########## DF-2426 control END: 0 check(s) failed ##########
DFH: ==== DF-2426 trigger: block_size = 0 ====
DFH: calling amd_action: Fatal trap 18 imminent on the verbatim kernel (amd.c:683, (1024L*1024L)/ccg->block_size with block_size=0)
DFH: ---- XPT_CALC_GEOMETRY block_size=0 volume_size=204800 (expecting DIVIDE BY ZERO at amd.c:683) ----
DFH: RESULT amd_action returned, xpt_done=1 status=0x04 heads=0 secs=0 cylinders=0
DFH: PASS: FIXED kernel: no trap; amd_action rejected block_size=0 with CAM_REQ_CMP_ERR
DFH: ==== DF-2426 trigger2: block_size = 2 MiB (passes the XPT garbage filter cam_xpt.c:3062; inner division yields 0) ====
DFH: calling amd_action: Fatal trap 18 imminent on the verbatim kernel (amd.c:683, volume_size/((1024L*1024L)/2097152) == volume_size/0)
DFH: ---- XPT_CALC_GEOMETRY block_size=2097152 volume_size=204800 (expecting inner div -> 0, OUTER DIVIDE BY ZERO at amd.c:683) ----
DFH: RESULT amd_action returned, xpt_done=1 status=0x04 heads=0 secs=0 cylinders=0
DFH: PASS: FIXED kernel: no trap; amd_action rejected the 2 MiB block_size with CAM_REQ_CMP_ERR
DFH: ########## DF-2427 battery mode=2 BEGIN ##########
DFH: layout sizeof(amd_srb)=384 sizeof(amd_softc)=99784 sizeof(amd_target_info)=12
DFH: layout offsetof dev=0 tag=8 bsh=16 dmat=24 unit=32 last_phase=36 cur_target=40 cur_lun=44 active_srb=48
DFH: layout offsetof untagged_srbs=56 tinfo=568 disc_count=664 (tinfo[6]..tinfo[7] = softc+640..663)
DFH: layout tinfo[-1] spans softc556..567: final 16 bytes of untagged_srbs[7][6] (softc552..567) + all of untagged_srbs[7][7] (softc568..575)
DFH: layout tinfo[-1] fields: disc_tag@556 CtrlR1@557 CtrlR3@558 CtrlR4@559 sync_period_reg@560 sync_offset_reg@561
DFH: layout disc_count[-1][0] @softc648 (tinfo[6] tail)
DFH: layout disc_count[-1][1] @softc650 (tinfo[6] tail)
DFH: layout disc_count[-1][2] @softc652 (tinfo[6] tail)
DFH: layout disc_count[-1][3] @softc654 (tinfo[6] tail)
DFH: layout disc_count[-1][4] @softc656 (tinfo[7] tail)
DFH: layout disc_count[-1][5] @softc658 (tinfo[7] tail)
DFH: layout disc_count[-1][6] @softc660 (tinfo[7] tail)
DFH: layout disc_count[-1][7] @softc662 (tinfo[7] tail)
DFH: layout untagged_srbs[-1][0] @softc-8 8 B BEFORE softc (heap hdr)
DFH: layout untagged_srbs[-1][1] @softc0 &amd->dev
DFH: layout untagged_srbs[-1][2] @softc8 &amd->tag
DFH: layout untagged_srbs[-1][3] @softc16 &amd->bsh
DFH: layout untagged_srbs[-1][4] @softc24 &amd->buffer_dmat
DFH: layout untagged_srbs[-1][5] @softc32 &amd->unit+last_phase
DFH: layout untagged_srbs[-1][6] @softc40 &amd->cur_target+cur_lun
DFH: layout untagged_srbs[-1][7] @softc48 &amd->active_srb
DFH: ==== DF-2427 scenario A: poison reselect byte 0x80 (= HostID_Bit), lun 0 ====
DFH: pre-state softc-16..-1 softc-16 [a5a5a5a5a5a5a5a5 58fe7981ffffffff]
DFH: pre-state tinfo[6]..[7] softc640 [0000000000000000 0000000000000000 0000000000000000]
DFH: pre-state: disc_count[-1][0] (tinfo[6].goal) = 0x0000, active_srb=0
amd0: Invalid reselection ID, resetting bus
DFH: post-reselect: cur_target=0 cur_lun=0 active_srb=0 (victim=0xffffffff8179fe58)
DFH: >>> kernel exhibits FIXED (reselect rejected) behavior <<<
DFH: PASS: rejected reselect left active_srb NULL
DFH: *** FAIL: both canary rings intact (no OOB access)
DFH: PASS: tinfo tail intact (no OOB decrement)
DFH: PASS: victim object untouched (no write through a wild pointer)
DFH: chip after rejected reselect CMD=03 DESTID=80 INTSTAT=04 SYNCPERIOD=00 SYNCOFF=00 C1=00 C3=00 C4=00 DMAcmd=00 (FIFO=00)
DFH: PASS: driver answered with SCSI bus reset
DFH: ==== DF-2427 scenario A2: poison byte 0x80, lun 6 (field-alias variant; deref=1) ====
amd0: Invalid reselection ID, resetting bus
DFH: post-reselect: cur_target=0 cur_lun=0 active_srb=0
DFH: >>> kernel exhibits FIXED (reselect rejected) behavior <<<
DFH: PASS: rejected reselect left active_srb NULL
DFH: PASS: no OOB access (pre-ring intact)
DFH: chip after rejected reselect CMD=03 DESTID=80 INTSTAT=04 SYNCPERIOD=00 SYNCOFF=00 C1=00 C3=00 C4=00 DMAcmd=00 (FIFO=00)
DFH: follow-on skipped: no wild pointer was installed
DFH: ==== DF-2427 scenario B: multi-bit byte 0xA8, attacker on wire at ID 5, decodes to target 3 ====
amd0: Invalid reselection ID, resetting bus
DFH: post-reselect: cur_target=40 cur_lun=0 active_srb=0 (target-3 SRB=0xffffffff8179fcd8)
DFH: >>> kernel exhibits FIXED (multi-bit reselect rejected) behavior <<<
DFH: PASS: target-3 nexus untouched (no SRB confusion)
DFH: PASS: both canary rings intact
DFH: chip after rejected reselect CMD=03 DESTID=80 INTSTAT=04 SYNCPERIOD=00 SYNCOFF=00 C1=00 C3=00 C4=00 DMAcmd=00 (FIFO=00)
DFH: PASS: driver answered with SCSI bus reset
DFH: ==== DF-2427 scenario C: valid byte 0xA0 -> target 5 (control) ====
DFH: post-reselect: cur_target=5 cur_lun=0 active_srb=0xffffffff8179fb58 (target-5 SRB=0xffffffff8179fb58)
DFH: PASS: valid reselect binds the correct nexus
DFH: chip after amd_Reselect CMD=12 DESTID=05 INTSTAT=04 SYNCPERIOD=50 SYNCOFF=0f C1=75 C3=35 C4=54 DMAcmd=00 (FIFO=00)
DFH: PASS: chip programmed for target 5
DFH: PASS: control run leaves both canary rings intact
DFH: ########## DF-2427 battery mode=2 END: 1 check(s) failed ##########
DFH: ########## DF-2427 battery mode=2 BEGIN ##########
DFH: layout sizeof(amd_srb)=384 sizeof(amd_softc)=99784 sizeof(amd_target_info)=12
DFH: layout offsetof dev=0 tag=8 bsh=16 dmat=24 unit=32 last_phase=36 cur_target=40 cur_lun=44 active_srb=48
DFH: layout offsetof untagged_srbs=56 tinfo=568 disc_count=664 (tinfo[6]..tinfo[7] = softc+640..663)
DFH: layout tinfo[-1] spans softc556..567: final 16 bytes of untagged_srbs[7][6] (softc552..567) + all of untagged_srbs[7][7] (softc568..575)
DFH: layout tinfo[-1] fields: disc_tag@556 CtrlR1@557 CtrlR3@558 CtrlR4@559 sync_period_reg@560 sync_offset_reg@561
DFH: layout disc_count[-1][0] @softc648 (tinfo[6] tail)
DFH: layout disc_count[-1][1] @softc650 (tinfo[6] tail)
DFH: layout disc_count[-1][2] @softc652 (tinfo[6] tail)
DFH: layout disc_count[-1][3] @softc654 (tinfo[6] tail)
DFH: layout disc_count[-1][4] @softc656 (tinfo[7] tail)
DFH: layout disc_count[-1][5] @softc658 (tinfo[7] tail)
DFH: layout disc_count[-1][6] @softc660 (tinfo[7] tail)
DFH: layout disc_count[-1][7] @softc662 (tinfo[7] tail)
DFH: layout untagged_srbs[-1][0] @softc-8 8 B BEFORE softc (heap hdr)
DFH: layout untagged_srbs[-1][1] @softc0 &amd->dev
DFH: layout untagged_srbs[-1][2] @softc8 &amd->tag
DFH: layout untagged_srbs[-1][3] @softc16 &amd->bsh
DFH: layout untagged_srbs[-1][4] @softc24 &amd->buffer_dmat
DFH: layout untagged_srbs[-1][5] @softc32 &amd->unit+last_phase
DFH: layout untagged_srbs[-1][6] @softc40 &amd->cur_target+cur_lun
DFH: layout untagged_srbs[-1][7] @softc48 &amd->active_srb
DFH: ==== DF-2427 scenario A: poison reselect byte 0x80 (= HostID_Bit), lun 0 ====
DFH: pre-state softc-16..-1 softc-16 [a5a5a5a5a5a5a5a5 58fe7981ffffffff]
DFH: pre-state tinfo[6]..[7] softc640 [0000000000000000 0000000000000000 0000000000000000]
DFH: pre-state: disc_count[-1][0] (tinfo[6].goal) = 0x0000, active_srb=0
amd0: Invalid reselection ID, resetting bus
DFH: post-reselect: cur_target=0 cur_lun=0 active_srb=0 (victim=0xffffffff8179fe58)
DFH: >>> kernel exhibits FIXED (reselect rejected) behavior <<<
DFH: PASS: rejected reselect left active_srb NULL
DFH: *** FAIL: both canary rings intact (no OOB access)
DFH: PASS: tinfo tail intact (no OOB decrement)
DFH: PASS: victim object untouched (no write through a wild pointer)
DFH: chip after rejected reselect CMD=03 DESTID=80 INTSTAT=04 SYNCPERIOD=00 SYNCOFF=00 C1=00 C3=00 C4=00 DMAcmd=00 (FIFO=00)
DFH: PASS: driver answered with SCSI bus reset
DFH: ==== DF-2427 scenario A2: poison byte 0x80, lun 6 (field-alias variant; deref=1) ====
amd0: Invalid reselection ID, resetting bus
DFH: post-reselect: cur_target=0 cur_lun=0 active_srb=0
DFH: >>> kernel exhibits FIXED (reselect rejected) behavior <<<
DFH: PASS: rejected reselect left active_srb NULL
DFH: PASS: no OOB access (pre-ring intact)
DFH: chip after rejected reselect CMD=03 DESTID=80 INTSTAT=04 SYNCPERIOD=00 SYNCOFF=00 C1=00 C3=00 C4=00 DMAcmd=00 (FIFO=00)
DFH: follow-on skipped: no wild pointer was installed
DFH: ==== DF-2427 scenario B: multi-bit byte 0xA8, attacker on wire at ID 5, decodes to target 3 ====
amd0: Invalid reselection ID, resetting bus
DFH: post-reselect: cur_target=40 cur_lun=0 active_srb=0 (target-3 SRB=0xffffffff8179fcd8)
DFH: >>> kernel exhibits FIXED (multi-bit reselect rejected) behavior <<<
DFH: PASS: target-3 nexus untouched (no SRB confusion)
DFH: PASS: both canary rings intact
DFH: chip after rejected reselect CMD=03 DESTID=80 INTSTAT=04 SYNCPERIOD=00 SYNCOFF=00 C1=00 C3=00 C4=00 DMAcmd=00 (FIFO=00)
DFH: PASS: driver answered with SCSI bus reset
DFH: ==== DF-2427 scenario C: valid byte 0xA0 -> target 5 (control) ====
DFH: post-reselect: cur_target=5 cur_lun=0 active_srb=0xffffffff8179fb58 (target-5 SRB=0xffffffff8179fb58)
DFH: PASS: valid reselect binds the correct nexus
DFH: chip after amd_Reselect CMD=12 DESTID=05 INTSTAT=04 SYNCPERIOD=50 SYNCOFF=0f C1=75 C3=35 C4=54 DMAcmd=00 (FIFO=00)
DFH: PASS: chip programmed for target 5
DFH: PASS: control run leaves both canary rings intact
DFH: ########## DF-2427 battery mode=2 END: 1 check(s) failed ##########
boot() called on cpu#1
Switching to cpu #0 for shutdown
Waiting (max 60 seconds) for system thread swapcached to stop...stopped
Waiting (max 60 seconds) for system thread vnlru to stop...stopped
Waiting (max 60 seconds) for system thread consttyd to stop...stopped
Waiting (max 60 seconds) for system thread bufdaemon to stop...stopped
Waiting (max 60 seconds) for system thread bufdaemon_hw to stop...stopped
syncing disks... 0 0 0
done
v-chain 0xfffff8008fb404c0 volume.0 0000000000000010 0000000000000000/0 mir=0000000000000110
[00002000] (?) refs=1
f-chain 0xfffff8008fb40640 freemap.0 0000000000000010 0000000000000000/0 mir=0000000000000110
[00002000] (?) refs=1
Uptime: 3m23s
Rebooting...
Copyright (c) 2003-2026 The DragonFly Project.
Copyright (c) 1992-2003 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
DragonFly 6.5-DEVELOPMENT #6: Mon Oct 19 13:14:51 UTC 2026
root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC
acpi_hpet: frequency 100000000
Using cputimer HPET for TSC calibration
Timer latency (in TSC ticks): 33973 min=32420 max=87842
TSC clock: 3600010665 Hz, NOT invariant
CPU: QEMU Virtual CPU version 2.5+ (3600.01-MHz K8-class CPU)
Origin="GenuineIntel" Id=0x60fb1 Family=0xf Model=0x6b Stepping=1
Features=0x1783fbfd<FPU,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR,SSE,SSE2,HTT>
Features2=0x80202001<SSE3,CX16,x2APIC,VMM>
AMD Features=0x20100800<SYSCALL,NX,LM>
AMD Features2=0x1<LAHF>
MONITOR/MWAIT Features=0x2<INTBRK>
VMM/Hypervisor: Origin="KVMKVMKVM"
real memory = 4293381120 (4094 MB)
avail memory = 4088664064 (3899 MB)
LAPIC: enter X2APIC mode
madt_lapic_probe: lapic_count=6 x2apic_count=0
ACPI CPUS = 6
lapic: divisor index 0, frequency 500002909 Hz
CPU Topology: cores_per_chip: 6; threads_per_core: 1; chips_per_package: 1;
srat_probe: can't locate SRAT
SMI Frequency (worst case): 40000 Hz (25 us)
Initialize MI interrupts for 6 cpus
TSC is not invariant, no further tests will be performed
Spectre: support=( none ) req=ffff operating=( none )
MDS: support=( none ) req=ffff operating=( none )
machdep.meltdown_mitigation enabled to protect against (mostly Intel) meltdown bug
system call performance will be impacted
interrupt uses mplock: swi_taskq
wdog: In-kernel automatic watchdog reset enabled
md0: Malloc disk
evdev device loaded.
kbd1 at kbdmux0
ACPI: RSDP 0x00000000000F59A0 000014 (v00 BOCHS )
ACPI: RSDT 0x00000000BFFE1CAC 000034 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: FACP 0x00000000BFFE1B38 000074 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: DSDT 0x00000000BFFE0040 001AF8 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: FACS 0x00000000BFFE0000 000040
ACPI: APIC 0x00000000BFFE1BAC 0000A0 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: HPET 0x00000000BFFE1C4C 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: WAET 0x00000000BFFE1C84 000028 (v01 BOCHS BXPC 00000001 BXPC 00000001)
sc0: <System console> on motherboard
sc0: VGA <16 virtual consoles, flags=0x100>
acpi0: <BOCHS BXPC> on motherboard
ACPI: 1 ACPI AML tables successfully acquired and loaded
ACPI FADT: SCI testing interrupt mode ...
ACPI FADT: SCI select level/high
acpi0: Power Button (fixed)
acpi_hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
acpi_timer0 on acpi0
isab0: <ACPI Generic ISA bridge> on acpi0
isa0: <ISA bus> on isab0
cpu0: <ACPI CPU> on acpi0
cpu_cst0: <ACPI CPU C-State> on cpu0
cpu1: <ACPI CPU> on acpi0
cpu_cst1: <ACPI CPU C-State> on cpu1
cpu2: <ACPI CPU> on acpi0
cpu_cst2: <ACPI CPU C-State> on cpu2
cpu3: <ACPI CPU> on acpi0
cpu_cst3: <ACPI CPU C-State> on cpu3
cpu4: <ACPI CPU> on acpi0
cpu_cst4: <ACPI CPU C-State> on cpu4
cpu5: <ACPI CPU> on acpi0
cpu_cst5: <ACPI CPU C-State> on cpu5
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
isab1: <PCI-ISA bridge> at device 1.0 on pci0
isa1: <ISA bus> on isab1
atapci0: <Intel PIIX3 WDMA2 controller> port 0xc0a0-0xc0af,0x376,0x170-0x177,0x3f6,0x1f0-0x1f7 at device 1.1 on pci0
ata0: <ATA channel 0> on atapci0
interrupt uses mplock: ata0
ata1: <ATA channel 1> on atapci0
interrupt uses mplock: ata1
acd0: DVDROM <QEMU DVD-ROM/2.5+> at ata1-master WDMA2
pci0: <bridge> (vendor 0x8086, dev 0x7113) at device 1.3 irq 9
vgapci0: <VGA-compatible display> mem 0xfebd0000-0xfebd0fff,0xfd000000-0xfdffffff at device 2.0 on pci0
vgapci0: Boot video device
virtio_pci0: <VirtIO PCI Network adapter> port 0xc080-0xc09f mem 0xfe000000-0xfe003fff,0xfebd1000-0xfebd1fff irq 11 at device 3.0 on pci0
vtnet0: <VirtIO Networking Adapter> on virtio_pci0
virtio_pci0: host features: 0x79bf8064 <EventIdx,RingIndirect,AnyLayout,NotifyOnEmpty,SetMacAddress,GuestAnnounce,RxModeExtra,VLanFilter,RxMode,ControlVq,Status,MrgRxBuf,TxAllGSO,MacAddress,DynOffload>
virtio_pci0: negotiated features: 0x198f8020 <RingIndirect,AnyLayout,NotifyOnEmpty,SetMacAddress,VLanFilter,RxMode,ControlVq,Status,MrgRxBuf,MacAddress>
virtio_pci0: using 3 MSI-X vectors
vtnet0: MAC address: 52:54:00:12:34:56
virtio_pci1: <VirtIO PCI Block adapter> port 0xc000-0xc07f mem 0xfe004000-0xfe007fff,0xfebd2000-0xfebd2fff irq 11 at device 4.0 on pci0
vtblk0: <VirtIO Block Adapter> on virtio_pci1
virtio_pci1: host features: 0x79007e54 <EventIdx,RingIndirect,AnyLayout,NotifyOnEmpty,WriteZeroes,Discard,MultiQueue,ConfigWCE,Topology,FlushCommand,BlockSize,DiskGeometry,MaxNumSegs>
virtio_pci1: negotiated features: 0x10001a54 <RingIndirect,MultiQueue,ConfigWCE,FlushCommand,BlockSize,DiskGeometry,MaxNumSegs>
virtio_pci1: using 6 MSI-X vectors
vtblk0: Virtio: ncylinders at legacy maximum (16383), recalculating to 62415
vtblk0: Block size: 512
vtblk0: 30720MB (62914560 512 byte sectors: 16H 63S/T 16383C)
atkbdc0: <Keyboard controller (i8042)> port 0x64,0x60 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
psm0: <PS/2 Mouse> irq 12 on atkbdc0
interrupt uses mplock: psm0
psm0: model IntelliMouse Explorer, device ID 4
sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 on acpi0
sio0: type 16550A, console
ACPI: Enabled 2 GPEs in block 00 to 0F
rdrand0: No RdRand support.
orm0: <ISA Option ROM> at iomem 0xe8000-0xeffff on isa1
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa1
sio2: can't drain, serial port might not exist, disabling
hpt27xx: no controller detected.
CAM: Configuring 2 busses
CAM: finished configuring all busses
cd0 at ata1 bus 0 target 0 lun 0
cd0: <QEMU QEMU DVD-ROM 2.5+> Removable CD-ROM SCSI-0 device
cd0: 16.000MB/s transfers
cd0: Attempt to query device size failed: NOT READY, Medium not present
Mounting root from hammer2:vbd0s1d
hammer2_mount: root devstr="vbd0s1d"
hammer2_mount: device="vbd0s1d" label="ROOT" rdonly=1
hammer2_ondisk: "/dev/vbd0s1d" zone=1 id=0 offset=0x0000000000000000 size=0x000000063f000000
hammer2_mount: hmp=0xfffff8008fac0000 pmp=0xfffff80090260000
DMA space used: 13580k, remaining available: 131072k
Mounting devfs
hammer2_mount: "vbd0s1d": no recovery needed
hammer2: enable read/write
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
swap low/high-water marks set to 41940/62910
DFH: ########## DF-2426 control BEGIN ##########
DFH: ==== DF-2426 control: block_size = 512 ====
DFH: ---- XPT_CALC_GEOMETRY block_size=512 volume_size=204800 (expecting sane geometry) ----
DFH: RESULT amd_action returned, xpt_done=1 status=0x01 heads=64 secs=32 cylinders=100
DFH: PASS: nonzero block_size computes 64/32/100 geometry, CAM_REQ_CMP
DFH: ########## DF-2426 control END: 0 check(s) failed ##########
DFH: ==== DF-2426 trigger: block_size = 0 ====
DFH: calling amd_action: Fatal trap 18 imminent on the verbatim kernel (amd.c:683, (1024L*1024L)/ccg->block_size with block_size=0)
DFH: ---- XPT_CALC_GEOMETRY block_size=0 volume_size=204800 (expecting DIVIDE BY ZERO at amd.c:683) ----
DFH: RESULT amd_action returned, xpt_done=1 status=0x04 heads=0 secs=0 cylinders=0
DFH: PASS: FIXED kernel: no trap; amd_action rejected block_size=0 with CAM_REQ_CMP_ERR
DFH: ==== DF-2426 trigger2: block_size = 2 MiB (passes the XPT garbage filter cam_xpt.c:3062; inner division yields 0) ====
DFH: calling amd_action: Fatal trap 18 imminent on the verbatim kernel (amd.c:683, volume_size/((1024L*1024L)/2097152) == volume_size/0)
DFH: ---- XPT_CALC_GEOMETRY block_size=2097152 volume_size=204800 (expecting inner div -> 0, OUTER DIVIDE BY ZERO at amd.c:683) ----
DFH: RESULT amd_action returned, xpt_done=1 status=0x04 heads=0 secs=0 cylinders=0
DFH: PASS: FIXED kernel: no trap; amd_action rejected the 2 MiB block_size with CAM_REQ_CMP_ERR
DFH: ########## DF-2427 battery mode=2 BEGIN ##########
DFH: layout sizeof(amd_srb)=384 sizeof(amd_softc)=99784 sizeof(amd_target_info)=12
DFH: layout offsetof dev=0 tag=8 bsh=16 dmat=24 unit=32 last_phase=36 cur_target=40 cur_lun=44 active_srb=48
DFH: layout offsetof untagged_srbs=56 tinfo=568 disc_count=664 (tinfo[6]..tinfo[7] = softc+640..663)
DFH: layout tinfo[-1] spans softc556..567: final 16 bytes of untagged_srbs[7][6] (softc552..567) + all of untagged_srbs[7][7] (softc568..575)
DFH: layout tinfo[-1] fields: disc_tag@556 CtrlR1@557 CtrlR3@558 CtrlR4@559 sync_period_reg@560 sync_offset_reg@561
DFH: layout disc_count[-1][0] @softc648 (tinfo[6] tail)
DFH: layout disc_count[-1][1] @softc650 (tinfo[6] tail)
DFH: layout disc_count[-1][2] @softc652 (tinfo[6] tail)
DFH: layout disc_count[-1][3] @softc654 (tinfo[6] tail)
DFH: layout disc_count[-1][4] @softc656 (tinfo[7] tail)
DFH: layout disc_count[-1][5] @softc658 (tinfo[7] tail)
DFH: layout disc_count[-1][6] @softc660 (tinfo[7] tail)
DFH: layout disc_count[-1][7] @softc662 (tinfo[7] tail)
DFH: layout untagged_srbs[-1][0] @softc-8 8 B BEFORE softc (heap hdr)
DFH: layout untagged_srbs[-1][1] @softc0 &amd->dev
DFH: layout untagged_srbs[-1][2] @softc8 &amd->tag
DFH: layout untagged_srbs[-1][3] @softc16 &amd->bsh
DFH: layout untagged_srbs[-1][4] @softc24 &amd->buffer_dmat
DFH: layout untagged_srbs[-1][5] @softc32 &amd->unit+last_phase
DFH: layout untagged_srbs[-1][6] @softc40 &amd->cur_target+cur_lun
DFH: layout untagged_srbs[-1][7] @softc48 &amd->active_srb
DFH: ==== DF-2427 scenario A: poison reselect byte 0x80 (= HostID_Bit), lun 0 ====
DFH: pre-state softc-16..-1 softc-16 [a5a5a5a5a5a5a5a5 58fe7981ffffffff]
DFH: pre-state tinfo[6]..[7] softc640 [0000000000000000 0000000000000000 0000000000000000]
DFH: pre-state: disc_count[-1][0] (tinfo[6].goal) = 0x0000, active_srb=0
amd0: Invalid reselection ID, resetting bus
DFH: post-reselect: cur_target=0 cur_lun=0 active_srb=0 (victim=0xffffffff8179fe58)
DFH: >>> kernel exhibits FIXED (reselect rejected) behavior <<<
DFH: PASS: rejected reselect left active_srb NULL
DFH: PASS: canary rings intact (no OOB access; pre[56..63] holds our own pre-loaded victim pointer)
DFH: PASS: tinfo tail intact (no OOB decrement)
DFH: PASS: victim object untouched (no write through a wild pointer)
DFH: chip after rejected reselect CMD=03 DESTID=80 INTSTAT=04 SYNCPERIOD=00 SYNCOFF=00 C1=00 C3=00 C4=00 DMAcmd=00 (FIFO=00)
DFH: PASS: driver answered with SCSI bus reset
DFH: ==== DF-2427 scenario A2: poison byte 0x80, lun 6 (field-alias variant; deref=1) ====
amd0: Invalid reselection ID, resetting bus
DFH: post-reselect: cur_target=0 cur_lun=0 active_srb=0
DFH: >>> kernel exhibits FIXED (reselect rejected) behavior <<<
DFH: PASS: rejected reselect left active_srb NULL
DFH: PASS: no OOB access (pre-ring intact)
DFH: chip after rejected reselect CMD=03 DESTID=80 INTSTAT=04 SYNCPERIOD=00 SYNCOFF=00 C1=00 C3=00 C4=00 DMAcmd=00 (FIFO=00)
DFH: follow-on skipped: no wild pointer was installed
DFH: ==== DF-2427 scenario B: multi-bit byte 0xA8, attacker on wire at ID 5, decodes to target 3 ====
amd0: Invalid reselection ID, resetting bus
DFH: post-reselect: cur_target=40 cur_lun=0 active_srb=0 (target-3 SRB=0xffffffff8179fcd8)
DFH: >>> kernel exhibits FIXED (multi-bit reselect rejected) behavior <<<
DFH: PASS: target-3 nexus untouched (no SRB confusion)
DFH: PASS: both canary rings intact
DFH: chip after rejected reselect CMD=03 DESTID=80 INTSTAT=04 SYNCPERIOD=00 SYNCOFF=00 C1=00 C3=00 C4=00 DMAcmd=00 (FIFO=00)
DFH: PASS: driver answered with SCSI bus reset
DFH: ==== DF-2427 scenario C: valid byte 0xA0 -> target 5 (control) ====
DFH: post-reselect: cur_target=5 cur_lun=0 active_srb=0xffffffff8179fb58 (target-5 SRB=0xffffffff8179fb58)
DFH: PASS: valid reselect binds the correct nexus
DFH: chip after amd_Reselect CMD=12 DESTID=05 INTSTAT=04 SYNCPERIOD=50 SYNCOFF=0f C1=75 C3=35 C4=54 DMAcmd=00 (FIFO=00)
DFH: PASS: chip programmed for target 5
DFH: PASS: control run leaves both canary rings intact
DFH: ########## DF-2427 battery mode=2 END: 0 check(s) failed ##########