# DF-2875 — pipelined BLK_WRITE: single-slot iost->data aux tracking →
# premature kfree of in-flight bp->b_data (UAF during disk I/O) + leak

## What this pack contains

- `dfpeer.c` — dmsg wire peer (socketpair + DIOCRECLUSTER + hand-crafted
  DMSG_BLK_* frames; the kernel reader verifies no CRCs, so frames are
  hand-built).
- `run_f2.sh` — the trigger + readback scan + malloc accounting.
- `f2_scan.txt` — readback of all written offsets after 10 rounds:
  * W2 slots containing `aa aa aa aa` (the victim bio DMA'd a *reclaimer's*
    buffer contents — the freed slot was reallocated before the DMA),
  * a W2 slot containing `53 ff 00 f0` (raw allocator/kernel memory
    persisted to disk),
  * several slots containing ASCII `"cals"` (kernel heap string data
    persisted to disk).
- `f2_mem_before.txt` / `f2_mem_after.txt` — `vmstat -m dmsg_disk`:
  in-use **2.19K → 2.28M** across 10 rounds (orphaned detached aux).
- `fix.diff` (kern_dmsg.c/subr_disk.c hunks included for completeness) —
  per-bio aux ownership via `bio_caller_info2.ptr`.

## Build & run (root on the DF guest; root == stand-in for the
authenticated dmsg cluster peer, the same threat position as DF-0117)

```
cc -O -Wall -o /tmp/dfpeer dfpeer.c        # build.sh
pkill -f hammer2                            # free boot-time disk iocoms
sh run_f2.sh                                # run.sh (~2 min)
```

## Expected output (stock kernel)

- `pipelines: 10 rounds done`
- readscan anomalies: W2 slots (off+005/007/009... odd 6*i+1 offsets)
  showing `aa aa aa aa`, `53 ff 00 f0`, or ASCII garbage instead of
  their own `0x22+r` pattern
- dmsg_disk in-use growth ~2.3MB (leak)

On the **fix kernel**, the same run shows every slot with exactly its own
pattern (W1 `0x11+r`, W2 `0x22+r`, reclaimers `0xAA`) and no dmsg_disk
growth.