# DF-3017 x DF-2694 COMPOSED CHAIN — the escalation-path execution record
# (captured 2026-10-17 ~04:45 UTC, 2-vCPU instantiation of the STOCK
# kernel, rig `df3017c` as uid 1001; DDB trace over the serial console)
#
# trap: kernel: type 9 trap (GP) at dev_dioctl+0x5f
#
# trace:
dev_dioctl() at dev_dioctl+0x5f 0xffffffff8062cdaf
(null)() at 0x140000240000100 0x140000240000100
devfs_vop_getattr() at devfs_vop_getattr+0x1f2 0xffffffff80920ee2
vop_getattr() at vop_getattr+0x50 0xffffffff8070a240
vn_stat() at vn_stat+0x33 0xffffffff80708623
kern_stat() at kern_stat+0x45 0xffffffff80704895
sys_lstat() at sys_lstat+0x57 0xffffffff80704a07
syscall2() at syscall2+0x11e 0xffffffff80bd6a0e
#
# DECODE (full narrative in VERDICT.md "Chain-composition run"):
#  * A victim lstat raced a pty destroy through devfs_vop_nresolve's
#    devfs_allocv lock-drop (window A), read the freed/reclaimed chunks,
#    PASSED sysref_get's SRF_PUTAWAY KKASSERT, associated the poisoned
#    vnode and cached it (cache_setvp).
#  * The SAME lstat then executed devfs_vop_getattr's D_DISK branch ->
#    dev_dioctl -> `call *dev->si_ops->d_ioctl`.  The "call target"
#    0x140000240000100 is the attacker's USERSPACE OPS-SPRAY pattern
#    qword ((D_DISK|D_MPSAFE|D_QUICK)<<32 | SC_ADDR): the dispatch went
#    THROUGH attacker-controlled userspace memory.  The #GP is on the
#    non-canonical v1 pattern value itself (the junk si_ops happened to
#    be 8-mod-16 aligned, so +72 picked pat[0] instead of pat[1]=SC).
#  * spray v2 (uniform V = 0x0000000240000100, ring0-stub copy at
#    0x240000100) makes the very same call land inside the cred-zeroing
#    stub.  It was raced in all subsequent attempts; no draw converted
#    before the session closed (see VERDICT.md for the residual
#    per-hit lottery).