DF-2534 baseline evidence (kernel #2 Mon Oct 19 20:55:04, INVARIANTS, verbatim xdisk.c)

=== [1] UAF-read hammer: real xa_size vs real xa_terminate_check (12 s) ===
DF2534-RACE: === DF-2534: real xa_size (cpu0) vs real xa_terminate_check (cpu1) for 12 s ===
DF2534-RACE: *** UAF READ CAPTURED (#1): real xa_size dereferenced FREED-then-REUSED softc through the stale si_drv1 pointer (result=0x00c0ffee00df2534)
DF2534-RACE: *** UAF READ CAPTURED (#2): real xa_size dereferenced FREED-then-REUSED softc through the stale si_drv1 pointer (result=0x00c0ffee00df2534)
DF2534-RACE: *** UAF READ CAPTURED (#3): real xa_size dereferenced FREED-then-REUSED softc through the stale si_drv1 pointer (result=0x00c0ffee00df2534)
login: DF2534-RACE: reader xa_size iterations: 157024256 (ENXIO/NULL path: 151101622)
DF2534-RACE: terminator terminate_check iterations: 51550501 (same-address reuse: 51550501, other: 0)
DF2534-RACE: UAF READS CAPTURED (stale deref saw 0xC0FFEE00DF2534 written AFTER the free): 664
DF2534-RACE: USE-AFTER-FREE READ CONFIRMED in the real xa_size
DF2534-RACE: done

=== [2] xa_strategy NULL deref (fabricated post-drain state; see panic.txt) ===
login: DF2534-S: === DF-2534: xa_strategy with si_drv1 == NULL (xdisk.c:801,805) ===
DF2534-S: calling real xa_strategy: xdisk.c:801 loads sc=NULL, :805 devstat_start_transaction(&sc->stats) derefs ~NULL+offset -> kernel page fault
Fatal user address access from kernel mode from sysctl at ffffffff806928fa


Fatal trap 12: page fault while in kernel mode
cpuid = 4; lapic id = 4
fault virtual address	= 0x90
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff806928fa
stack pointer	        = 0x10:0xfffff80117ab3720
frame pointer	        = 0x10:0xfffff80117ab3798
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 820
current thread          = pri 6 
kernel: type 12 trap, code=2

CPU4 stopping CPUs: 0x0000002f
 stopped
Stopped at      devstat_start_transaction+0xa:  lock xaddl      %eax,0x58(%rdi)
db> 

=== [3] same triggers after fix.diff (kernel #3 Mon Oct 19 21:13:06) ===
DF2534-S: === DF-2534: xa_strategy with si_drv1 == NULL (xdisk.c:801,805) ===
DF2534-S: calling real xa_strategy: xdisk.c:801 loads sc=NULL, :805 devstat_start_transaction(&sc->stats) derefs ~NULL+offset -> kernel page fault
DF2534-S: harness bio_done fired (bio completed with b_error=6 b_flags=0x800)
DF2534-S: xa_strategy returned 0 without faulting (fixed?) bio_done=6
DF2534-S: done
DF2534-RACE: === DF-2534: real xa_size (cpu0) vs real xa_terminate_check (cpu1) for 12 s ===
DF2534-RACE: reader xa_size iterations: 82313216 (ENXIO/NULL path: 82313216)
DF2534-RACE: terminator terminate_check iterations: 30146560 (same-address reuse: 30146560, other: 0)
DF2534-RACE: UAF READS CAPTURED (stale deref saw 0xC0FFEE00DF2534 written AFTER the free): 0
DF2534-RACE: no stale read observed this run (see VERDICT.md)
DF2534-RACE: done