inet6 fe80::5054:ff:fe12:3456%vtnet0 prefixlen 64 tentative scopeid 0x1
	media: Ethernet 1000baseT <full-duplex>
	status: active
route: writing to routing socket: File exists
add net default: gateway 10.0.2.2: File exists
Additional routing options:.
Starting devd.
Additional TCP options:.
Mounting NFS file systems:.
ELF ldconfig path: /lib /usr/lib /usr/local/lib /usr/local/libdata/ldconfig/pkg
Building databases...
Starting syslogd.
Oct 14 13:43:59 dfbsd syslogd: kernel boot file is /boot/kernel/kernel

No core dumps found.
swap low/high-water marks set to 41940/62910
swapon: adding /dev/vbd0s1b as swap device
NFS CLIENT: access_cache_timeout=5 neg_cache_timeout=3.
Starting local daemons:.
Updating motd.
Configuring syscons: blanktime.
Starting sshd.
sendmail_submit: /etc/mail/aliases.db not present,  generating
sendmail_clientmqueue: /etc/mail/aliases.db not present,  generating
Starting cron.
Local package initialization:.

Wed Oct 14 13:43:59 UTC 2026


DragonFly/x86_64 (dfbsd) (ttyd0)



login: df252x: rig loaded (set kern.df252x.addr from kldstat+nm, then kern.df252x.go=N)
df252x[32]: layouts: sizeof(scsi_sense_data)=32 sizeof(ccb_scsiio)=320 sizeof(union ccb)=720 offsetof(csio,sense_data)=236 sense_data+max_copy=491
df252x[32]: dispatching production trm_Interrupt: DISCONNECT completion of SRB 0xfffff801175fabc0 TagNumber=255, SRBFlag=AUTO_REQSENSE, csio->sense_len=32, sense DMA slot=255 (last of 256)
df252x[32]: trm_Interrupt RETURNED (guest alive)
df252x[32]: SRBdone ran: pDCB->pActiveSRB=0 (cleared by trm.c:2402), pACB->pFreeSRB=0xfffff801175fabc0==SRB, GoingSRBCnt=0, pSRBSGL->address=0x11111111 (restored 0x11111111), SRBTotalXferLength=0x55555555 (restored 0x55555555), CmdBlock[0]=0x33 (restored 0x33), ccb_h.status=0x0000008c (CAM_SCSI_STATUS_ERROR|CAM_AUTOSNS_VALID)
df252x[32]: dest sense_data[0..31]: all 0x51 (DMA slot pattern): YES; first bytes: 51 51 51 51
df252x[32]: control: dest[32]=0x20 (0xDB sentinel untouched), sense_len still 0x20, scsi_status=0x02 (CHECK_COND intact) - NO overflow
df252x[32]: write extent: 0 bytes past sense_data start; in-struct live-field clobber bytes=0; sentinel bytes past sizeof(union ccb) clobbered=0 (expected 0) -> OOB WRITE past the ccb heap allocation: no (write stayed in-struct)
df252x[255]: layouts: sizeof(scsi_sense_data)=32 sizeof(ccb_scsiio)=320 sizeof(union ccb)=720 offsetof(csio,sense_data)=236 sense_data+max_copy=491
df252x[255]: dispatching production trm_Interrupt: DISCONNECT completion of SRB 0xfffff801175fabc0 TagNumber=255, SRBFlag=AUTO_REQSENSE, csio->sense_len=255, sense DMA slot=255 (last of 256)
df252x[255]: trm_Interrupt RETURNED (guest alive)
df252x[255]: SRBdone ran: pDCB->pActiveSRB=0 (cleared by trm.c:2402), pACB->pFreeSRB=0xfffff801175fabc0==SRB, GoingSRBCnt=0, pSRBSGL->address=0x11111111 (restored 0x11111111), SRBTotalXferLength=0x55555555 (restored 0x55555555), CmdBlock[0]=0x33 (restored 0x33), ccb_h.status=0x0000008c (CAM_SCSI_STATUS_ERROR|CAM_AUTOSNS_VALID)
df252x[255]: dest sense_data[0..31]: all 0x51 (DMA slot pattern): YES; first bytes: 51 51 51 51
df252x[255]: *** dest bytes [32..255) = 0xA7 (pattern that exists ONLY past the 256-slot sense_buffers array): CONFIRMED (223/223 bytes) -> OOB READ past the 32-byte DMA sense slot ***
df252x[255]: clobbered LIVE ccb fields: sense_len=0xa7 cdb_len=0xa7 sglist_cnt=0xa7a7 scsi_status=0xa7(set to 0x02 by trm.c:2528, overwritten!) sense_resid=0xa7 resid=0xa7a7a7a7 cdb_io.cdb_ptr=0xa7a7a7a7a7a7a7a7 msg_ptr=0xa7a7a7a7a7a7a7a7 msg_len=0xa7a7 tag_action=0xa7 tag_id=0xa7a7a7a7 init_id=0xa7a7a7a7
df252x[255]: write extent: 223 bytes past sense_data start; in-struct live-field clobber bytes=223; sentinel bytes past sizeof(union ccb) clobbered=0 (expected 0) -> OOB WRITE past the ccb heap allocation: no (write stayed in-struct)
df2523[ctl]: ring[0] TargetID=1 LUN=0 packed=0x0001 pActiveSRB=0
df2523[ctl]: ring[1] TargetID=2 LUN=0 packed=0x0002 pActiveSRB=0
df2523[ctl]: ring[2] TargetID=3 LUN=2 packed=0x0203 pActiveSRB=0
df2523[ctl]: RselTarLunId=0x0203 (TRMREG_SCSI_TARGETID & 0x1FFF, trm.c:2426)
df2523[ctl]: dispatching production trm_Interrupt (RESELECTED, matching ID) - expect clean return
df2523[ctl]: trm_Interrupt RETURNED: pActiveDCB=ring[2] (YES), ring[2]->pActiveSRB=&TmpSRB (YES), TmpSRB.SRBState=0x8000 (SRB_UNEXPECT_RESEL=0x8000), TmpSRB.MsgOutBuf[0]=0x06 (MSG_ABORT), MsgCnt=1, SCSI_CONTROL write=0x0002
df2523[T1]: ring[0] TargetID=1 LUN=0 packed=0x0001 pActiveSRB=0
df2523[T1]: ring[1] TargetID=2 LUN=0 packed=0x0002 pActiveSRB=0
df2523[T1]: ring[2] TargetID=3 LUN=2 packed=0x0203 pActiveSRB=0
df2523[T1]: RselTarLunId=0x1000 (TRMREG_SCSI_TARGETID & 0x1FFF, trm.c:2426)
df2523[T1]: entering production trm_Interrupt (RESELECTED, RselTarLunId=0x1000 matches NO DCB of the 3-DCB circular list)
df2523[HB]: *** NON-TERMINATION CONFIRMED: 3.-08038 s inside trm_Interrupt/trm_Reselect - the DCB ring walk (trm.c:2428-2431) has no exit ***
df2523[HB]: *** NON-TERMINATION CONFIRMED: 6.-07982 s inside trm_Interrupt/trm_Reselect - the DCB ring walk (trm.c:2428-2431) has no exit ***
df2523[HB]: *** NON-TERMINATION CONFIRMED: 9.002041 s inside trm_Interrupt/trm_Reselect - the DCB ring walk (trm.c:2428-2431) has no exit ***