DF-3426 / panic_uaf_run2_serial.txt
XMMNNOO-\|/-\|/-\|/-\|/
1. Boot DragonFly [kernel] ,--, ,--,
2. Boot DragonFly in Safe Mode | `-, _:_ ,-' |
3. Boot DragonFly without AHCI driver `, `-, (/ \) ,-' ,'
4. Boot DragonFly without ACPI driver `-, `-,/ \,-' ,-'
9. Escape to loader prompt (also ESC) `------{ }------'
r. Boot DragonFly to a rescue ramdisk ,----------{ }----------,
s. Boot DragonFly in single user mode | _,-{ }-,_ |
v. Boot DragonFly with verbose logging `-,__,-' \ / `-,__,-'
R. Reboot | |
| |
| |
| |
| |
| |
`,'
Booting in 10 seconds...
Booting in 9 seconds...
Booting in 8 seconds...
Booting in 7 seconds...
Booting in 6 seconds...
Booting in 5 seconds...
Booting in 4 seconds...
Booting in 3 seconds...
Booting in 2 seconds...
Booting in 1 second...
Booting in 0 seconds...
-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-kernel (from /boot/kernel/kernel) text=0xbce540 \|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-data=0x177b17+0x9dfde9 \|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/syms=[0x8+0xf7e18-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|+0x8+0xba8d0/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\]
|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/ehci.ko -\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/size 0x7c288 at 0x1cd9000
-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\xhci.ko |/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\size 0x8c778 at 0x1d56000
|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\Copyright (c) 2003-2026 The DragonFly Project.
Copyright (c) 1992-2003 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026
root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC
acpi_hpet: frequency 100000000
Using cputimer HPET for TSC calibration
Timer latency (in TSC ticks): 40753 min=39528 max=66422
TSC clock: 3600011144 Hz, NOT invariant
CPU: QEMU Virtual CPU version 2.5+ (3600.01-MHz K8-class CPU)
Origin="GenuineIntel" Id=0x60fb1 Family=0xf Model=0x6b Stepping=1
Features=0x1783fbfd<FPU,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR,SSE,SSE2,HTT>
Features2=0x80202001<SSE3,CX16,x2APIC,VMM>
AMD Features=0x20100800<SYSCALL,NX,LM>
AMD Features2=0x1<LAHF>
MONITOR/MWAIT Features=0x2<INTBRK>
VMM/Hypervisor: Origin="KVMKVMKVM"
real memory = 4293381120 (4094 MB)
avail memory = 4088926208 (3899 MB)
LAPIC: enter X2APIC mode
madt_lapic_probe: lapic_count=6 x2apic_count=0
ACPI CPUS = 6
lapic: divisor index 0, frequency 500003233 Hz
CPU Topology: cores_per_chip: 6; threads_per_core: 1; chips_per_package: 1;
srat_probe: can't locate SRAT
SMI Frequency (worst case): 29411 Hz (34 us)
Initialize MI interrupts for 6 cpus
TSC is not invariant, no further tests will be performed
Spectre: support=( none ) req=ffff operating=( none )
MDS: support=( none ) req=ffff operating=( none )
machdep.meltdown_mitigation enabled to protect against (mostly Intel) meltdown bug
system call performance will be impacted
interrupt uses mplock: swi_taskq
wdog: In-kernel automatic watchdog reset enabled
md0: Malloc disk
evdev device loaded.
kbd1 at kbdmux0
ACPI: RSDP 0x00000000000F59A0 000014 (v00 BOCHS )
ACPI: RSDT 0x00000000BFFE1CAC 000034 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: FACP 0x00000000BFFE1B38 000074 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: DSDT 0x00000000BFFE0040 001AF8 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: FACS 0x00000000BFFE0000 000040
ACPI: APIC 0x00000000BFFE1BAC 0000A0 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: HPET 0x00000000BFFE1C4C 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: WAET 0x00000000BFFE1C84 000028 (v01 BOCHS BXPC 00000001 BXPC 00000001)
sc0: <System console> on motherboard
sc0: VGA <16 virtual consoles, flags=0x100>
acpi0: <BOCHS BXPC> on motherboard
ACPI: 1 ACPI AML tables successfully acquired and loaded
ACPI FADT: SCI testing interrupt mode ...
ACPI FADT: SCI select level/high
acpi0: Power Button (fixed)
acpi_hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
acpi_timer0 on acpi0
isab0: <ACPI Generic ISA bridge> on acpi0
isa0: <ISA bus> on isab0
cpu0: <ACPI CPU> on acpi0
cpu_cst0: <ACPI CPU C-State> on cpu0
cpu1: <ACPI CPU> on acpi0
cpu_cst1: <ACPI CPU C-State> on cpu1
cpu2: <ACPI CPU> on acpi0
cpu_cst2: <ACPI CPU C-State> on cpu2
cpu3: <ACPI CPU> on acpi0
cpu_cst3: <ACPI CPU C-State> on cpu3
cpu4: <ACPI CPU> on acpi0
cpu_cst4: <ACPI CPU C-State> on cpu4
cpu5: <ACPI CPU> on acpi0
cpu_cst5: <ACPI CPU C-State> on cpu5
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
isab1: <PCI-ISA bridge> at device 1.0 on pci0
isa1: <ISA bus> on isab1
atapci0: <Intel PIIX3 WDMA2 controller> port 0xc0a0-0xc0af,0x376,0x170-0x177,0x3f6,0x1f0-0x1f7 at device 1.1 on pci0
ata0: <ATA channel 0> on atapci0
interrupt uses mplock: ata0
ata1: <ATA channel 1> on atapci0
interrupt uses mplock: ata1
acd0: DVDROM <QEMU DVD-ROM/2.5+> at ata1-master WDMA2
pci0: <bridge> (vendor 0x8086, dev 0x7113) at device 1.3 irq 9
vgapci0: <VGA-compatible display> mem 0xfebd0000-0xfebd0fff,0xfd000000-0xfdffffff at device 2.0 on pci0
vgapci0: Boot video device
virtio_pci0: <VirtIO PCI Network adapter> port 0xc080-0xc09f mem 0xfe000000-0xfe003fff,0xfebd1000-0xfebd1fff irq 11 at device 3.0 on pci0
vtnet0: <VirtIO Networking Adapter> on virtio_pci0
virtio_pci0: host features: 0x79bf8064 <EventIdx,RingIndirect,AnyLayout,NotifyOnEmpty,SetMacAddress,GuestAnnounce,RxModeExtra,VLanFilter,RxMode,ControlVq,Status,MrgRxBuf,TxAllGSO,MacAddress,DynOffload>
virtio_pci0: negotiated features: 0x198f8020 <RingIndirect,AnyLayout,NotifyOnEmpty,SetMacAddress,VLanFilter,RxMode,ControlVq,Status,MrgRxBuf,MacAddress>
virtio_pci0: using 3 MSI-X vectors
vtnet0: MAC address: 52:54:00:12:34:56
virtio_pci1: <VirtIO PCI Block adapter> port 0xc000-0xc07f mem 0xfe004000-0xfe007fff,0xfebd2000-0xfebd2fff irq 11 at device 4.0 on pci0
vtblk0: <VirtIO Block Adapter> on virtio_pci1
virtio_pci1: host features: 0x79007e54 <EventIdx,RingIndirect,AnyLayout,NotifyOnEmpty,WriteZeroes,Discard,MultiQueue,ConfigWCE,Topology,FlushCommand,BlockSize,DiskGeometry,MaxNumSegs>
virtio_pci1: negotiated features: 0x10001a54 <RingIndirect,MultiQueue,ConfigWCE,FlushCommand,BlockSize,DiskGeometry,MaxNumSegs>
virtio_pci1: using 6 MSI-X vectors
vtblk0: Virtio: ncylinders at legacy maximum (16383), recalculating to 62415
vtblk0: Block size: 512
vtblk0: 30720MB (62914560 512 byte sectors: 16H 63S/T 16383C)
atkbdc0: <Keyboard controller (i8042)> port 0x64,0x60 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
psm0: <PS/2 Mouse> irq 12 on atkbdc0
interrupt uses mplock: psm0
psm0: model IntelliMouse Explorer, device ID 4
sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 on acpi0
sio0: type 16550A, console
ACPI: Enabled 2 GPEs in block 00 to 0F
rdrand0: No RdRand support.
orm0: <ISA Option ROM> at iomem 0xe8000-0xeffff on isa1
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa1
sio2: can't drain, serial port might not exist, disabling
hpt27xx: no controller detected.
CAM: Configuring 2 busses
CAM: finished configuring all busses
cd0 at ata1 bus 0 target 0 lun 0
cd0: <QEMU QEMU DVD-ROM 2.5+> Removable CD-ROM SCSI-0 device
cd0: 16.000MB/s transfers
cd0: Attempt to query device size failed: NOT READY, Medium not present
Mounting root from hammer2:vbd0s1d
hammer2_mount: root devstr="vbd0s1d"
hammer2_mount: device="vbd0s1d" label="ROOT" rdonly=1
hammer2_ondisk: "/dev/vbd0s1d" zone=2 id=0 offset=0x0000000000000000 size=0x000000063f000000
hammer2_mount: hmp=0xfffff8008fae0000 pmp=0xfffff80090280000
DMA space used: 13580k, remaining available: 131072k
Mounting devfs
Loading configuration files.
Loading devfs rules: /etc/defaults/devfs.conf.
Initializing random seed: done.
dumpon: crash dumps to /dev/vbd0s1b (25, 0x20001)
Starting file system checks:
/dev/vbd0s1a: 713 files, 408700 used, 114459 free (163 frags, 14287 blocks, 0.0% fragmentation)
mount_hammer2: unable to connect to cluster controller
mount_hammer2: cluster_connect(/dev/vbd0s1d@ROOT) failed
hammer2_mount: "vbd0s1d": no recovery needed
hammer2: enable read/write
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
mount_hammer2: unable to connect to cluster controller
mount_hammer2: cluster_connect(/dev/vbd0s1d@ROOT) failed
Mounting tmpfs at /var/run/shm.
Setting hostname: dfbsd.
Starting dhclient.
starting dhclient on vtnet0
lo0: flags=808049<UP,LOOPBACK,RUNNING,MULTICAST,PROXY> metric 0 mtu 16384
options=43<RXCSUM,TXCSUM,RSS>
inet 127.0.0.1 netmask 0xff000000
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
groups: lo
vtnet0: flags=808843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,PROXY> metric 0 mtu 1500
options=28<VLAN_MTU,JUMBO_MTU>
ether 52:54:00:12:34:56
inet6 fe80::5054:ff:fe12:3456%vtnet0 prefixlen 64 tentative scopeid 0x1
media: Ethernet 1000baseT <full-duplex>
status: active
route: writing to routing socket: File exists
add net default: gateway 10.0.2.2: File exists
Additional routing options:.
Starting devd.
Additional TCP options:.
Mounting NFS file systems:.
ELF ldconfig path: /lib /usr/lib /usr/local/lib /usr/local/libdata/ldconfig/pkg
Building databases...
Starting syslogd.
Oct 14 02:05:07 dfbsd syslogd: kernel boot file is /boot/kernel/kernel
No core dumps found.
swap low/high-water marks set to 41940/62910
swapon: adding /dev/vbd0s1b as swap device
NFS CLIENT: access_cache_timeout=5 neg_cache_timeout=3.
Starting local daemons:.
Updating motd.
Configuring syscons: blanktime.
Starting sshd.
sendmail_submit: /etc/mail/aliases.db not present, generating
sendmail_clientmqueue: /etc/mail/aliases.db not present, generating
Starting cron.
Local package initialization:.
Wed Oct 14 02:05:07 UTC 2026
DragonFly/x86_64 (dfbsd) (ttyd0)
login: tap0: MAC address: 00:bd:2c:16:00:00
netmap: loaded module
552.327793 generic_find_num_desc [149] called
552.332412 generic_find_num_queues [156] called
552.336871 netmap_get_hw_na [1023] Created generic NA 0xfffff80118818fc0 (prev 0)
552.344190 netmap_get_na [1085] getting 0xfffff80118818fc0:tap0 (0)
552.350469 netmap_mem_global_config [809] reconfiguring
585.705900 netmap_mem_finalize_all [684] Have 100 KB for interfaces, 7200 KB for rings and 320 MB for buffers
585.716866 netmap_mem_finalize_all [686] Free buffers: 163838
585.724193 generic_netmap_register [228] rtnl_lock called
585.729706 generic_netmap_register [240] rtnl_lock called
585.735493 netmap_mmap_single [321] cdev 0xfffff8008da31a00 foff 0 size 343019520 objp 0xfffff80116ff3618 prot 3
585.746220 netmap_dev_pager_ctor [208] handle 0xfffff8008d5e56c0 size 343019520 prot 3 foff 0
RIG: txsync enter: cur=8 hwcur=0 ntc=0 hwavail=1023 resv=0
585.758553 netmap_dev_pager_dtor [223] handle 0xfffff8008d5e56c0
585.765024 generic_netmap_register [255] rtnl_lock called
585.770408 generic_netmap_register [265] rtnl_lock called
585.776063 netmap_dtor_locked [657] putting 0xfffff80118818fc0:tap0 (1)
585.783400 generic_netmap_dtor [760] Restored native NA 0
603.147258 generic_find_num_desc [149] called
603.151686 generic_find_num_queues [156] called
603.157305 netmap_get_hw_na [1023] Created generic NA 0xfffff8008dfaf5c0 (prev 0)
603.165326 netmap_get_na [1085] getting 0xfffff8008dfaf5c0:tap0 (0)
603.171860 generic_netmap_register [228] rtnl_lock called
603.177590 generic_netmap_register [240] rtnl_lock called
603.184177 netmap_mmap_single [321] cdev 0xfffff8008da31a00 foff 0 size 343019520 objp 0xfffff80117d5b618 prot 3
603.195890 netmap_dev_pager_ctor [208] handle 0xfffff8008d402cd0 size 343019520 prot 3 foff 0
RIG: txsync enter: cur=512 hwcur=0 ntc=0 hwavail=1023 resv=0
RIG: txsync enter: cur=511 hwcur=512 ntc=0 hwavail=511 resv=0
RIG: txsync ring exhausted: ntc=512 j=511 hwavail=0 -> arming event
RIG: generic_set_tx_event e=1023 mbuf=0xfffff8012d4a0600 (SET_MBUF_DESTRUCTOR + m_freem on pool entry)
RIG: generic_mbuf_destructor CALLED m=0xfffff8008d402cc0 (ABI-incoherent ext_free(ext_arg) entry)
Trace beginning at frame 0xfffff8008d1f8890
m_free() at m_free+0x123 0xffffffff806bddc3
m_free() at m_free+0x123 0xffffffff806bddc3
m_freem() at m_freem+0x15 0xffffffff806be265
udp_input() at udp_input+0x2f8 0xffffffff807ccf18
transport_processing_oncpu.isra.7() at transport_processing_oncpu.isra.7+0x6b 0xffffffff807aee6b
ip_input() at ip_input+0x71f 0xffffffff807b10ef
netmsg_service_loop() at netmsg_service_loop+0xe9 0xffffffff807464a9
Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address = 0xffffffff00000076
fault code = supervisor read data, page not present
instruction pointer = 0x8:0xffffffff8262818f
stack pointer = 0x10:0xfffff8008d1f8870
frame pointer = 0x10:0xfffff8008d1f8890
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = Idle
current thread = pri 12
kernel: type 12 trap, code=0
CPU0 stopping CPUs: 0x0000003e
stopped
Stopped at generic_mbuf_destructor+0x3f: testb $0x80,0x75(%rdi)
db>