login: iscsi: version 2.1.0
panic: assertion "obj != NULL" failed in vm_object_hold_shared at /usr/src/sys/vm/vm_object.c:330
cpuid = 0
Trace beginning at frame 0xfffff801183eb558
vm_object_hold_shared() at vm_object_hold_shared+0x3f 0xffffffff809ab9bf 
vm_object_hold_shared() at vm_object_hold_shared+0x3f 0xffffffff809ab9bf 
vm_fault() at vm_fault+0x408 0xffffffff8099e0b8 
trap_pfault() at trap_pfault+0x9a 0xffffffff80bd52ca 
trap() at trap+0x17c 0xffffffff80bd5bcc 
calltrap() at calltrap+0x9 0xffffffff80b991fa 
--- trap 000000000000000c, rip = ffffffff80bcabf6, rsp = fffff801183eb970, rbp = fffff801183eb9c0 ---
memcpy() at memcpy+0x66 0xffffffff80bcabf6 
Debugger("panic")

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db> 

--- earlier run (bo=0x40000000): write-fault variant ---

=== Earlier reproduction (bo=0x40000000), direct write-fault ===
Fatal trap 12: page fault while in kernel mode
fault virtual address  = 0xfffff80157b32860
fault code             = supervisor write data, page not present     <-- WRITE
instruction pointer    = 0x8:0xffffffff80bcabf6
Stopped at      memcpy+0x66:    movq    %rdx,(%rdi)                  <-- i_mbufcopy memcpy

Both runs panic inside memcpy() called from i_mbufcopy() (iscsi_subr.c:574),
which scsi_decap() (iscsi_subr.c:574) reaches via dp = csio->data_ptr +
ntohl(rcmd->bo). The fault address = data_ptr + attacker-controlled bo.