=== DF-2462 FIXED-kernel battery Mon Oct 19 16:42:21 UTC 2026 ===
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #9: Mon Oct 19 16:36:19 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
--- scenario S0 (fixed) ---
debug.df2462.run: 0 -> 0
--- scenario S1 (fixed) ---
debug.df2462.run: 0 -> 0
--- scenario S2 (fixed) ---
debug.df2462.run: 0 -> 0
--- scenario S3 (fixed) ---
debug.df2462.run: 0 -> 0
--- scenario S4 (fixed) ---
debug.df2462.run: 0 -> 0
DF2462[S0] PATH_INQ: status=0x1 max_lun=2
DF2462[S0] stats handler: 'recv=111 sent=222 flags=0x00000000 pdus-alloc=0 pdus-max=0 cws=0 cmd=0 exp=0 max=0 stat=0 itt=0'
DF2462[S0] teardown clean: free_seen=1 sessions[7]=0
DF2462[S1] teardown parked after ic_lost_target (isc_sm.c:752 returned); sessions[7]=0 still set; sp=0xfffff8008971ef80 alive
DF2462[S1] PATH_INQ: status=0x8 max_lun=0
DF2462[S1] teardown completed: free_seen=1
DF2462[S2] victim parked in ic_action after sessions[] lookup (isc_cam.c:211), sp=0xfffff801179b3280
DF2462[S2] teardown state after 3s: stop_done=0 free_seen=0 reclaimed=0 sessions[7]=0
DF2462[S2] max_lun=0x2 = LIVE session value (the drain held the teardown until the victim was done -- the FIXED outcome)
DF2462[note] reclaim moved: 0xfffff801179b3280 -> 0xfffff80118491780 (continue)
DF2462[S3] victim parked inside isc_dump_stats before touching sp, sp=0xfffff8011831eb00
DF2462[S3] teardown state after 3s: stop_done=1 free_seen=0 reclaimed=0
DF2462[S3] handler exported from FREED chunk: 'recv=111 sent=222 flags=0x00000000 pdus-alloc=0 pdus-max=0 cws=0 cmd=0 exp=0 max=0 stat=0 itt=0' (error=0)
DF2462[S3] handler exported LIVE values (no freed-chunk data surfaced; on the FIXED tree this is the expected outcome: the drain held the teardown)
DF2462[note] reclaim moved: 0xfffff8011831eb00 -> 0xfffff8011854fc80 (continue)
DF2462[S4] victim parked in ic_action (SCSI_IO) holding sp=0xfffff801179b3700 via spriv_ptr0
DF2462[S4] no reclaim chunk (teardown still draining: the FIXED outcome)
DF2462[S4] victim used the LIVE session (drain held the teardown); no freed chunk exists to corrupt

--- scenario S6 (fixed): unprivileged userland reads in-window ---
debug.df2462.run: 0 -> 0
S6 busy=1 (expect 1: teardown parked; on the FIXED tree the OIDs resolve to sessions[sid]=NULL)
uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)
debug.df2462.s6done: 0 -> 0
DF2462[S0] PATH_INQ: status=0x1 max_lun=2
DF2462[S0] stats handler: 'recv=111 sent=222 flags=0x00000000 pdus-alloc=0 pdus-max=0 cws=0 cmd=0 exp=0 max=0 stat=0 itt=0'
DF2462[S0] teardown clean: free_seen=1 sessions[7]=0
DF2462[S1] teardown parked after ic_lost_target (isc_sm.c:752 returned); sessions[7]=0 still set; sp=0xfffff8008971ef80 alive
DF2462[S1] PATH_INQ: status=0x8 max_lun=0
DF2462[S1] teardown completed: free_seen=1
DF2462[S2] victim parked in ic_action after sessions[] lookup (isc_cam.c:211), sp=0xfffff801179b3280
DF2462[S2] teardown state after 3s: stop_done=0 free_seen=0 reclaimed=0 sessions[7]=0
DF2462[S2] max_lun=0x2 = LIVE session value (the drain held the teardown until the victim was done -- the FIXED outcome)
DF2462[note] reclaim moved: 0xfffff801179b3280 -> 0xfffff80118491780 (continue)
DF2462[S3] victim parked inside isc_dump_stats before touching sp, sp=0xfffff8011831eb00
DF2462[S3] teardown state after 3s: stop_done=1 free_seen=0 reclaimed=0
DF2462[S3] handler exported from FREED chunk: 'recv=111 sent=222 flags=0x00000000 pdus-alloc=0 pdus-max=0 cws=0 cmd=0 exp=0 max=0 stat=0 itt=0' (error=0)
DF2462[S3] handler exported LIVE values (no freed-chunk data surfaced; on the FIXED tree this is the expected outcome: the drain held the teardown)
DF2462[note] reclaim moved: 0xfffff8011831eb00 -> 0xfffff8011854fc80 (continue)
DF2462[S4] victim parked in ic_action (SCSI_IO) holding sp=0xfffff801179b3700 via spriv_ptr0
DF2462[S4] no reclaim chunk (teardown still draining: the FIXED outcome)
DF2462[S4] victim used the LIVE session (drain held the teardown); no freed chunk exists to corrupt
DF2462[S6] teardown parked; session OIDs still registered; run unprivileged reads now, then sysctl df2462.s6done=1
DF2462[S6] teardown completed after unprivileged reads: free_seen=1