DF-3454 / run.2.log
amrroob: loaded (sysctl amrroob.run=1 to start)
amrroob: algorithm=0xffffffff80d69ea0 interval=50 ticks (hz=100)
amrroob: node=0xfffff80118700400 size=12208 legacy rs_rates[0..14]=0xfffff8011870066e..0xfffff8011870067c
amrroob: &ni_chan=0xfffff80118700680 (rs_rates +18..+25) &ni_meshid=0xfffff80118700693 (+37) &ni_htrates.rs_rates=0xfffff80118700703 (+149)
amrroob: ni_chan pointer value = 0xfffff8008d5e0f50
amrroob: PHASE1 11n node_init -> amn_rix=67 (htrates nrates=77, legacy nrates=12)
amrroob: PHASE2 after 9 successful intervals -> amn_rix=76 (valid ONLY for the 77-entry htrates table)
amrroob: PHASE3 after HT->legacy flip: ratectl_rate() returned rix=76; legacy rs_nrates=12; amn_rix=76
amrroob: rix=76 indexes legacy rs_rates[76] => 0xfffff801187006ba is OOB (array ends at rs_rates[14]); byte actually read: 0x00 (ground truth 0x00 at that address)
amrroob: ni_txrate now 0xcc (leaked into every get-node info ioctl / isi_txrate)
amrroob: [rate_stats sysctl content]
amrroob: |rate: 0 Mbit
amrroob: |ticks: 177466
amrroob: |txcnt: 0
amrroob: |success: 0
amrroob: |success_threshold: 1
amrroob: |recovery: 1
amrroob: |retry_cnt: 0
amrroob: PHASE4 failure-driven walk-down, reading one OOB byte per interval (net.wlanX.rate_stats shows these as 'rate'):
amrroob: rix=75 -> read 0xfffff801187006b9 = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=74 -> read 0xfffff801187006b8 = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=73 -> read 0xfffff801187006b7 = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=72 -> read 0xfffff801187006b6 = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=71 -> read 0xfffff801187006b5 = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=70 -> read 0xfffff801187006b4 = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=69 -> read 0xfffff801187006b3 = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=68 -> read 0xfffff801187006b2 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=67 -> read 0xfffff801187006b1 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: PHASE5 tmp-node (empty ratesets): amn_rix=-1 ratectl_rate() returned -1 (drivers index rate tables with this; iwm_setrates KASSERTs rix>=0 -> INVARIANTS panic)
amrroob: [rate_stats sysctl content]
amrroob: |rate: 0 Mbit
amrroob: |ticks: 177958
amrroob: |txcnt: 0
amrroob: |success: 0
amrroob: |success_threshold: 1
amrroob: |recovery: 0
amrroob: |retry_cnt: 0
amrroob: DONE - OOB reads demonstrated via public ratectl API only; guest still alive
amrroob: unloaded
amrroob: loaded (sysctl amrroob.run=1 to start)
amrroob: algorithm=0xffffffff80d69ea0 interval=50 ticks (hz=100)
amrroob: node=0xfffff80118800400 size=12208 legacy rs_rates[0..14]=0xfffff8011880066e..0xfffff8011880067c
amrroob: &ni_chan=0xfffff80118800680 (rs_rates +18..+25) &ni_meshid=0xfffff80118800693 (+37) &ni_htrates.rs_rates=0xfffff80118800703 (+149)
amrroob: ni_chan pointer value = 0xfffff8008d403a30
amrroob: PHASE1 11n node_init -> amn_rix=67 (htrates nrates=77, legacy nrates=12)
amrroob: PHASE2 after 9 successful intervals -> amn_rix=76 (valid ONLY for the 77-entry htrates table)
amrroob: PHASE3 after HT->legacy flip: ratectl_rate() returned rix=76; legacy rs_nrates=12; amn_rix=76
amrroob: rix=76 indexes legacy rs_rates[76] => 0xfffff801188006ba is OOB (array ends at rs_rates[14]); byte actually read: 0x00 (ground truth 0x00 at that address)
amrroob: ni_txrate now 0xcc (leaked into every get-node info ioctl / isi_txrate)
amrroob: [rate_stats sysctl content]
amrroob: |rate: 0 Mbit
amrroob: |ticks: 183290
amrroob: |txcnt: 0
amrroob: |success: 0
amrroob: |success_threshold: 1
amrroob: |recovery: 1
amrroob: |retry_cnt: 0
amrroob: PHASE4 failure-driven walk-down, reading one OOB byte per interval (net.wlanX.rate_stats shows these as 'rate'):
amrroob: rix=75 -> read 0xfffff801188006b9 = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=74 -> read 0xfffff801188006b8 = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=73 -> read 0xfffff801188006b7 = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=72 -> read 0xfffff801188006b6 = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=71 -> read 0xfffff801188006b5 = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=70 -> read 0xfffff801188006b4 = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=69 -> read 0xfffff801188006b3 = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=68 -> read 0xfffff801188006b2 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=67 -> read 0xfffff801188006b1 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=66 -> read 0xfffff801188006b0 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=65 -> read 0xfffff801188006af = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=64 -> read 0xfffff801188006ae = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=63 -> read 0xfffff801188006ad = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=62 -> read 0xfffff801188006ac = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=61 -> read 0xfffff801188006ab = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=60 -> read 0xfffff801188006aa = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=59 -> read 0xfffff801188006a9 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=58 -> read 0xfffff801188006a8 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=57 -> read 0xfffff801188006a7 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=56 -> read 0xfffff801188006a6 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=55 -> read 0xfffff801188006a5 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=54 -> read 0xfffff801188006a4 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=53 -> read 0xfffff801188006a3 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=52 -> read 0xfffff801188006a2 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=51 -> read 0xfffff801188006a1 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=50 -> read 0xfffff801188006a0 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=49 -> read 0xfffff8011880069f = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=48 -> read 0xfffff8011880069e = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=47 -> read 0xfffff8011880069d = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=46 -> read 0xfffff8011880069c = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=45 -> read 0xfffff8011880069b = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=44 -> read 0xfffff8011880069a = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=43 -> read 0xfffff80118800699 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=42 -> read 0xfffff80118800698 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=41 -> read 0xfffff80118800697 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=40 -> read 0xfffff80118800696 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=39 -> read 0xfffff80118800695 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=38 -> read 0xfffff80118800694 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=37 -> read 0xfffff80118800693 = 0xa5 (ni_txrate/sysctl show 0x25) [0xA5 meshid marker]
amrroob: rix=36 -> read 0xfffff80118800692 = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=35 -> read 0xfffff80118800691 = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=34 -> read 0xfffff80118800690 = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=33 -> read 0xfffff8011880068f = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=32 -> read 0xfffff8011880068e = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=31 -> read 0xfffff8011880068d = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=30 -> read 0xfffff8011880068c = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=29 -> read 0xfffff8011880068b = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=28 -> read 0xfffff8011880068a = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=27 -> read 0xfffff80118800689 = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=26 -> read 0xfffff80118800688 = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: rix=25 -> read 0xfffff80118800687 = 0xff (ni_txrate/sysctl show 0x7f) [ni_chan pointer byte]
amrroob: rix=24 -> read 0xfffff80118800686 = 0xff (ni_txrate/sysctl show 0x7f) [ni_chan pointer byte]
amrroob: rix=23 -> read 0xfffff80118800685 = 0xf8 (ni_txrate/sysctl show 0x78) [ni_chan pointer byte]
amrroob: rix=22 -> read 0xfffff80118800684 = 0x00 (ni_txrate/sysctl show 0x00) [ni_chan pointer byte]
amrroob: rix=21 -> read 0xfffff80118800683 = 0x8d (ni_txrate/sysctl show 0x0d) [ni_chan pointer byte]
amrroob: rix=20 -> read 0xfffff80118800682 = 0x40 (ni_txrate/sysctl show 0x40) [ni_chan pointer byte]
amrroob: rix=19 -> read 0xfffff80118800681 = 0x3a (ni_txrate/sysctl show 0x3a) [ni_chan pointer byte]
amrroob: rix=18 -> read 0xfffff80118800680 = 0x40 (ni_txrate/sysctl show 0x40) [ni_chan pointer byte]
amrroob: rix=17 -> read 0xfffff8011880067f = 0x00 (ni_txrate/sysctl show 0x00)
amrroob: PHASE5 tmp-node (empty ratesets): amn_rix=-1 ratectl_rate() returned -1 (drivers index rate tables with this; iwm_setrates KASSERTs rix>=0 -> INVARIANTS panic)
amrroob: [rate_stats sysctl content]
amrroob: |rate: 0 Mbit
amrroob: |ticks: 186471
amrroob: |txcnt: 0
amrroob: |success: 0
amrroob: |success_threshold: 1
amrroob: |recovery: 0
amrroob: |retry_cnt: 0
amrroob: DONE - OOB reads demonstrated via public ratectl API only; guest still alive
amrroob: unloaded
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
kern.version: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026
root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC
hw.machine: x86_64
hw.ncpu: 6
Id Refs Address Size Name
1 5 0xffffffff80200000 1ad8538 kernel
2 1 0xffffffff81cd9000 7c288 ehci.ko
3 1 0xffffffff81d56000 8c778 xhci.ko