# === BASELINE RUNS (stock INVARIANTS kernel #0) ===
# 40 rounds without poison: all "survived" (stale-contents deref is silent)
# [trimmed transcript of /tmp/df2687 40: round 0..39 closing orphaned slave /dev/pts/N ... survived]
# === DETERMINISTIC PANIC RUN ===
root# sysctl debug.use_weird_array=1
debug.use_weird_array: 0 -> 1
root# su -m pocs -c "/tmp/df2687 1"
(ssh session never returns; guest wedged at db>)
--- serial console (dfbsd-qemu boot.log) ---
Fatal trap 9: general protection fault while in kernel mode
cpuid = 4; lapic id = 4
instruction pointer     = 0x8:0xffffffff80679414
stack pointer           = 0x10:0xfffff80118e2b638
frame pointer           = 0x10:0xfffff80118e2b668
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 2179
current thread          = pri 10
kernel: type 9 trap, code=0
CPU4 stopping CPUs: 0x0000002f
 stopped
Stopped at      lwkt_gettoken+0x64:     movq    (%r12),%rax
db>
# lwkt_gettoken dereferences sp->s_prg (poisoned 0xdeadc0de...) from
# ttyclearsession() on the orphaned slave close. GP fault (non-canonical).