Additional routing options:.
Starting devd.
Additional TCP options:.
Mounting NFS file systems:.
ELF ldconfig path: /lib /usr/lib /usr/local/lib /usr/local/libdata/ldconfig/pkg
Building databases...
Starting syslogd.
Oct 19 21:00:33 dfbsd syslogd: kernel boot file is /boot/kernel/kernel

No core dumps found.
swap low/high-water marks set to 41940/62910
swapon: adding /dev/vbd0s1b as swap device
NFS CLIENT: access_cache_timeout=5 neg_cache_timeout=3.
Starting local daemons:.
Updating motd.
Configuring syscons: blanktime.
Starting sshd.
sendmail_submit: /etc/mail/aliases.db not present,  generating
sendmail_clientmqueue: /etc/mail/aliases.db not present,  generating
Starting cron.
Local package initialization:.

Mon Oct 19 21:00:34 UTC 2026
DF2533-A: === DF-2533 path 1: xa_close with si_drv1 == NULL (xdisk.c:769-770) ===
DF2533-A: before xa_close: xdisk_lk lockstatus=0
DF2533-A: xa_close returned 6
DF2533-A: xdisk_lk lockstatus=2 after return (LK_EXCLUSIVE=2 => EXCLUSIVE LOCK LEAKED)
DF2533-A: probe real-xa_open thread: started=1 finished=0 => STUCK FOREVER on leaked xdisk_lk (all later xdisk ops deadlock)
DF2533-A: cleanup: harness released the leaked xdisk_lk (a real caller never could)
DF2533-A: probe thread completed: finished=1 xa_open=6
DF2533-A: done
DF2534-RACE: === DF-2534: real xa_size (cpu0) vs real xa_terminate_check (cpu1) for 12 s ===
DF2534-RACE: *** UAF READ CAPTURED (#1): real xa_size dereferenced FREED-then-REUSED softc through the stale si_drv1 pointer (result=0x00c0ffee00df2534)
DF2534-RACE: *** UAF READ CAPTURED (#2): real xa_size dereferenced FREED-then-REUSED softc through the stale si_drv1 pointer (result=0x00c0ffee00df2534)
DF2534-RACE: *** UAF READ CAPTURED (#3): real xa_size dereferenced FREED-then-REUSED softc through the stale si_drv1 pointer (result=0x00c0ffee00df2534)


DragonFly/x86_64 (dfbsd) (ttyd0)



login: DF2534-RACE: reader xa_size iterations: 157024256 (ENXIO/NULL path: 151101622)
DF2534-RACE: terminator terminate_check iterations: 51550501 (same-address reuse: 51550501, other: 0)
DF2534-RACE: UAF READS CAPTURED (stale deref saw 0xC0FFEE00DF2534 written AFTER the free): 664
DF2534-RACE: USE-AFTER-FREE READ CONFIRMED in the real xa_size
DF2534-RACE: done
DF2533-B: === DF-2533 path 2: xa_close with sc->terminating == 1 (xdisk.c:771-773) ===
DF2533-B: sc=0xfffff801184a7880 sc->terminating=1 sc->lk.lk_count=0x0
DF2533-B: calling real xa_close: expect xdisk.c:772 lockmgr(&sc->lk, LK_RELEASE) on the NEVER-acquired sc->lk -> lockmgr_release() unconditional panic (kern_lock.c:768), while xdisk_lk stays held
panic: lockmgr: LK_RELEASE: no lock held
cpuid = 2
Trace beginning at frame 0xfffff801182b76a8
lockmgr_release() at lockmgr_release+0x11a 0xffffffff80647cea 
lockmgr_release() at lockmgr_release+0x11a 0xffffffff80647cea 
xa_close() at xa_close+0x183 0xffffffff80a822a3 
df33_close_term() at df33_close_term+0xd0 0xffffffff80a82660 
sysctl_root.isra.5() at sysctl_root.isra.5+0x166 0xffffffff80684046 
userland_sysctl() at userland_sysctl+0x111 0xffffffff806843e1 
Debugger("panic")

CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdbe99(%rip)
db>