# DF-3858 run.2.log — case-B verbatim-access proof (guest objdump) and signal record
# (guest: DragonFly dfbsd 6.5-DEVELOPMENT, cc 8.3; /tmp/od_div0 built -O2)

$ vm.sh run_root 'objdump -d /tmp/od_div0 | sed -n "/<main>:/,/ret/p" | grep -B4 -A12 "shl\|imul\|div"'
  40071b:	83 e8 01             	sub    $0x1,%eax            <- count - 1 (uint32 wrap)
  40071e:	8b 0c c5 f8 1e 40 00 	mov    0x401ef8(,%rax,8),%ecx  <- THE wild load, rax=0xFFFFFFFF
  400725:	8d 41 ff             	lea    -0x1(%rcx),%eax
  400728:	99                   	cltd
  400729:	f7 f9                	idiv   %ecx                   <- DIV_ROUND_UP divide
  40072b:	89 c6                	mov    %eax,%esi
  40072f:	e8 8c ff ff ff       	callq  4006c0 <printf@plt>

# effective address of the wild load: 0x401ef8 + 0xFFFFFFFF*8 = 0x401ef8 + 0x7FFFFFFF8
# = 34,359,738,360 bytes past the object base - the load really executes; in this
# userland process it landed on an unrelated mapped page (returned 0). In the kernel
# the same offset relative to a kmalloc'd vega20_hwmgr backend is a wild OOB read.

# signal record (dmesg, from the shared verification session):
$ dmesg | grep -i -E "trap|fpe|signal 8|od_div0"
  pid 1340 (od_div0), uid 0: exited on signal 8 (core dumped)
  pid 1342 (od_div0), uid 0: exited on signal 8 (core dumped)
  pid 1397 (od_div0), uid 0: exited on signal 8 (core dumped)

$ rm -f /tmp/od_div0* /tmp/od.b64 && echo CLEANED