df252x: rig loaded (set kern.df252x.addr from kldstat+nm, then kern.df252x.go=N)
df252x[32]: layouts: sizeof(scsi_sense_data)=32 sizeof(ccb_scsiio)=320 sizeof(union ccb)=720 offsetof(csio,sense_data)=236 sense_data+max_copy=491
df252x[32]: dispatching production trm_Interrupt: DISCONNECT completion of SRB 0xfffff8008bb64320 TagNumber=255, SRBFlag=AUTO_REQSENSE, csio->sense_len=32, sense DMA slot=255 (last of 256)
df252x[32]: trm_Interrupt RETURNED (guest alive)
df252x[32]: SRBdone ran: pDCB->pActiveSRB=0 (cleared by trm.c:2402), pACB->pFreeSRB=0xfffff8008bb64320==SRB, GoingSRBCnt=0, pSRBSGL->address=0x11111111 (restored 0x11111111), SRBTotalXferLength=0x55555555 (restored 0x55555555), CmdBlock[0]=0x33 (restored 0x33), ccb_h.status=0x0000008c (CAM_SCSI_STATUS_ERROR|CAM_AUTOSNS_VALID)
df252x[32]: dest sense_data[0..31]: all 0x51 (DMA slot pattern): YES; first bytes: 51 51 51 51
df252x[32]: control: dest[32]=0x20 (0xDB sentinel untouched), sense_len still 0x20, scsi_status=0x02 (CHECK_COND intact) - NO overflow
df252x[32]: write extent: 0 bytes past sense_data start; in-struct live-field clobber bytes=0; sentinel bytes past sizeof(union ccb) clobbered=0 (expected 0) -> OOB WRITE past the ccb heap allocation: no (write stayed in-struct)
df252x[255]: layouts: sizeof(scsi_sense_data)=32 sizeof(ccb_scsiio)=320 sizeof(union ccb)=720 offsetof(csio,sense_data)=236 sense_data+max_copy=491
df252x[255]: dispatching production trm_Interrupt: DISCONNECT completion of SRB 0xfffff8008bb64320 TagNumber=255, SRBFlag=AUTO_REQSENSE, csio->sense_len=255, sense DMA slot=255 (last of 256)
df252x[255]: trm_Interrupt RETURNED (guest alive)
df252x[255]: SRBdone ran: pDCB->pActiveSRB=0 (cleared by trm.c:2402), pACB->pFreeSRB=0xfffff8008bb64320==SRB, GoingSRBCnt=0, pSRBSGL->address=0x11111111 (restored 0x11111111), SRBTotalXferLength=0x55555555 (restored 0x55555555), CmdBlock[0]=0x33 (restored 0x33), ccb_h.status=0x0000008c (CAM_SCSI_STATUS_ERROR|CAM_AUTOSNS_VALID)
df252x[255]: dest sense_data[0..31]: all 0x51 (DMA slot pattern): YES; first bytes: 51 51 51 51
df252x[255]: *** dest bytes [32..255) = 0xA7 (pattern that exists ONLY past the 256-slot sense_buffers array): ABSENT - COPY WAS CLAMPED (0/223 bytes) -> OOB READ past the 32-byte DMA sense slot ***
df252x[255]: clobbered LIVE ccb fields: sense_len=0xff cdb_len=0x00 sglist_cnt=0x0000 scsi_status=0x02(set to 0x02 by trm.c:2528, overwritten!) sense_resid=0x00 resid=0x00000000 cdb_io.cdb_ptr=0x0000000000000000 msg_ptr=0x0000000000000000 msg_len=0x0000 tag_action=0x00 tag_id=0x00000000 init_id=0x00000000
df252x[255]: write extent: 223 bytes past sense_data start; in-struct live-field clobber bytes=2; sentinel bytes past sizeof(union ccb) clobbered=0 (expected 0) -> OOB WRITE past the ccb heap allocation: no (write stayed in-struct)
df2523[ctl]: ring[0] TargetID=1 LUN=0 packed=0x0001 pActiveSRB=0
df2523[ctl]: ring[1] TargetID=2 LUN=0 packed=0x0002 pActiveSRB=0
df2523[ctl]: ring[2] TargetID=3 LUN=2 packed=0x0203 pActiveSRB=0
df2523[ctl]: RselTarLunId=0x0203 (TRMREG_SCSI_TARGETID & 0x1FFF, trm.c:2426)
df2523[ctl]: dispatching production trm_Interrupt (RESELECTED, matching ID) - expect clean return
df2523[ctl]: trm_Interrupt RETURNED: pActiveDCB=ring[2] (YES), ring[2]->pActiveSRB=&TmpSRB (YES), TmpSRB.SRBState=0x8000 (SRB_UNEXPECT_RESEL=0x8000), TmpSRB.MsgOutBuf[0]=0x06 (MSG_ABORT), MsgCnt=1, SCSI_CONTROL write=0x0002
df2524: offsetof(SRB,pccb)=88 -> faulting read at 0x58
df2524: dispatching production trm_Interrupt: DISCONNECT with pACB->pActiveDCB=0xfffff8008faabc70, pDCB->pActiveSRB=NULL (trm.c:2354) - expect NULL deref panic at trm.c:2356 ("/* bug pSRB=0 */")
df2524: trm_Interrupt RETURNED - no NULL deref (guard present)
df2523[T1]: ring[0] TargetID=1 LUN=0 packed=0x0001 pActiveSRB=0
df2523[T1]: ring[1] TargetID=2 LUN=0 packed=0x0002 pActiveSRB=0
df2523[T1]: ring[2] TargetID=3 LUN=2 packed=0x0203 pActiveSRB=0
df2523[T1]: RselTarLunId=0x1000 (TRMREG_SCSI_TARGETID & 0x1FFF, trm.c:2426)
df2523[T1]: entering production trm_Interrupt (RESELECTED, RselTarLunId=0x1000 matches NO DCB of the 3-DCB circular list)
df2523[T1]: trm_Interrupt RETURNED (unreachable on vulnerable kernel)