DF-3454 / fix_module_only.log
amrroob.run: 0 -> 0 RC=0 ===DMESG=== amrroob: loaded (sysctl amrroob.run=1 to start) amrroob: algorithm=0xffffffff80d69ea0 interval=50 ticks (hz=100) amrroob: node=0xfffff801183c0400 size=12208 legacy rs_rates[0..14]=0xfffff801183c066e..0xfffff801183c067c amrroob: &ni_chan=0xfffff801183c0680 (rs_rates +18..+25) &ni_meshid=0xfffff801183c0693 (+37) &ni_htrates.rs_rates=0xfffff801183c0703 (+149) amrroob: ni_chan pointer value = 0xfffff8008d700f60 amrroob: PHASE1 11n node_init -> amn_rix=67 (htrates nrates=77, legacy nrates=12) amrroob: PHASE2 after 9 successful intervals -> amn_rix=76 (valid ONLY for the 77-entry htrates table) amrroob: PHASE3 after HT->legacy flip: ratectl_rate() returned rix=76; legacy rs_nrates=12; amn_rix=76 amrroob: rix=76 indexes legacy rs_rates[76] => 0xfffff801183c06ba is OOB (array ends at rs_rates[14]); byte actually read: 0x00 (ground truth 0x00 at that address) amrroob: ni_txrate now 0xcc (leaked into every get-node info ioctl / isi_txrate) amrroob: [rate_stats sysctl content] amrroob: |rate: 0 Mbit amrroob: |ticks: 2594 amrroob: |txcnt: 0 amrroob: |success: 0 amrroob: |success_threshold: 1 amrroob: |recovery: 1 amrroob: |retry_cnt: 0 amrroob: PHASE4 failure-driven walk-down, reading one OOB byte per interval (net.wlanX.rate_stats shows these as 'rate'): amrroob: rix=75 -> read 0xfffff801183c06b9 = 0x00 (ni_txrate/sysctl show 0x00) amrroob: rix=74 -> read 0xfffff801183c06b8 = 0x00 (ni_txrate/sysctl show 0x00) amrroob: rix=73 -> read 0xfffff801183c06b7 = 0x00 (ni_txrate/sysctl show 0x00) amrroob: rix=72 -> read 0xfffff801183c06b6 = 0x00 (ni_txrate/sysctl show 0x00) amrroob: rix=71 -> read 0xfffff801183c06b5 = 0x00 (ni_txrate/sysctl show 0x00) amrroob: rix=70 -> read 0xfffff801183c06b4 = 0x00 (ni_txrate/sysctl show 0x00) amrroob: rix=69 -> read 0xfffff801183c06b3 = 0x00 (ni_txrate/sysctl show 0x00) amrroob: rix=68 -> read 0xfffff801183c06b2 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=67 -> read 0xfffff801183c06b1 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=66 -> read 0xfffff801183c06b0 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=65 -> read 0xfffff801183c06af = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=64 -> read 0xfffff801183c06ae = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=63 -> read 0xfffff801183c06ad = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=62 -> read 0xfffff801183c06ac = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=61 -> read 0xfffff801183c06ab = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=60 -> read 0xfffff801183c06aa = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=59 -> read 0xfffff801183c06a9 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=58 -> read 0xfffff801183c06a8 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=57 -> read 0xfffff801183c06a7 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=56 -> read 0xfffff801183c06a6 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=55 -> read 0xfffff801183c06a5 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=54 -> read 0xfffff801183c06a4 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=53 -> read 0xfffff801183c06a3 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=52 -> read 0xfffff801183c06a2 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=51 -> read 0xfffff801183c06a1 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=50 -> read 0xfffff801183c06a0 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=49 -> read 0xfffff801183c069f = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=48 -> read 0xfffff801183c069e = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=47 -> read 0xfffff801183c069d = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=46 -> read 0xfffff801183c069c = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=45 -> read 0xfffff801183c069b = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=44 -> read 0xfffff801183c069a = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=43 -> read 0xfffff801183c0699 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=42 -> read 0xfffff801183c0698 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=41 -> read 0xfffff801183c0697 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=40 -> read 0xfffff801183c0696 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=39 -> read 0xfffff801183c0695 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=38 -> read 0xfffff801183c0694 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=37 -> read 0xfffff801183c0693 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker] amrroob: rix=36 -> read 0xfffff801183c0692 = 0x00 (ni_txrate/sysctl show 0x00) amrroob: rix=35 -> read 0xfffff801183c0691 = 0x00 (ni_txrate/sysctl show 0x00) amrroob: rix=34 -> read 0xfffff801183c0690 = 0x00 (ni_txrate/sysctl show 0x00) amrroob: rix=33 -> read 0xfffff801183c068f = 0x00 (ni_txrate/sysctl show 0x00) amrroob: rix=32 -> read 0xfffff801183c068e = 0x00 (ni_txrate/sysctl show 0x00) amrroob: rix=31 -> read 0xfffff801183c068d = 0x00 (ni_txrate/sysctl show 0x00) amrroob: rix=30 -> read 0xfffff801183c068c = 0x00 (ni_txrate/sysctl show 0x00) amrroob: rix=29 -> read 0xfffff801183c068b = 0x00 (ni_txrate/sysctl show 0x00) amrroob: rix=28 -> read 0xfffff801183c068a = 0x00 (ni_txrate/sysctl show 0x00) amrroob: rix=27 -> read 0xfffff801183c0689 = 0x00 (ni_txrate/sysctl show 0x00) amrroob: rix=26 -> read 0xfffff801183c0688 = 0x00 (ni_txrate/sysctl show 0x00) amrroob: rix=25 -> read 0xfffff801183c0687 = 0xff (ni_txrate/sysctl show 0x7f) [ni_chan pointer byte] amrroob: rix=24 -> read 0xfffff801183c0686 = 0xff (ni_txrate/sysctl show 0x7f) [ni_chan pointer byte] amrroob: rix=23 -> read 0xfffff801183c0685 = 0xf8 (ni_txrate/sysctl show 0x78) [ni_chan pointer byte] amrroob: rix=22 -> read 0xfffff801183c0684 = 0x00 (ni_txrate/sysctl show 0x00) [ni_chan pointer byte] amrroob: rix=21 -> read 0xfffff801183c0683 = 0x8d (ni_txrate/sysctl show 0x0d) [ni_chan pointer byte] amrroob: rix=20 -> read 0xfffff801183c0682 = 0x70 (ni_txrate/sysctl show 0x70) [ni_chan pointer byte] amrroob: rix=19 -> read 0xfffff801183c0681 = 0x0f (ni_txrate/sysctl show 0x0f) [ni_chan pointer byte] amrroob: rix=18 -> read 0xfffff801183c0680 = 0x70 (ni_txrate/sysctl show 0x70) [ni_chan pointer byte] amrroob: rix=17 -> read 0xfffff801183c067f = 0x00 (ni_txrate/sysctl show 0x00) amrroob: PHASE5 tmp-node (empty ratesets): amn_rix=-1 ratectl_rate() returned -1 (drivers index rate tables with this; iwm_setrates KASSERTs rix>=0 -> INVARIANTS panic) amrroob: [rate_stats sysctl content] amrroob: |rate: 0 Mbit amrroob: |ticks: 5770 amrroob: |txcnt: 0 amrroob: |success: 0 amrroob: |success_threshold: 1 amrroob: |recovery: 0 amrroob: |retry_cnt: 0 amrroob: DONE - OOB reads demonstrated via public ratectl API only; guest still alive amrroob: unloaded