# DF-3932 run log — mly MLYIO_COMMAND DataTransferLength=INT_MIN kmalloc sink
# Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026 x86_64 (with-src snapshot)

$ vm.sh run_root 'kldload /root/kmod/ksink/kmallocsink.ko && sysctl kern.kmallocsink.fire=1'
sysctl: unknown oid 'kern.kmallocsink.fire'      # wrong oid name (node is kern.kmallocsink itself)
FIRE_RC=0

$ vm.sh run_root 'sysctl kern.kmallocsink=1; echo FIRE_RC=$?'
kern.kmallocsink: 0
[ no further output; ssh session hung: kernel panicked underneath the syscall ]

$ vm.sh status
down

# Serial console (vm.sh log):
kmallocsink: loaded
kmallocsink: kmalloc(0xffffffff80000000, M_DEVBUF, M_INTWAIT) ...
panic: kmem_slab_alloc(): kernel_map ran out of space!
cpuid = 1
Trace beginning at frame 0xfffff8011834f688
kmem_slab_alloc() at kmem_slab_alloc+0x42b 0xffffffff80656bab
kmem_slab_alloc() at kmem_slab_alloc+0x42b 0xffffffff80656bab
_kmalloc() at _kmalloc+0x5be 0xffffffff8065737e
fire_sysctl() at fire_sysctl+0x72 0xffffffff826000a2
sysctl_root.isra.5() at sysctl_root.isra.5+0x166 0xffffffff80683d06
userland_sysctl() at userland_sysctl+0x111 0xffffffff806840a1
Debugger("panic")
CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

# => SINK PROVEN: kmalloc(0xffffffff80000000, M_DEVBUF, M_INTWAIT) panics via
#    kmem_slab_alloc (sys/kern/kern_slaballoc.c:1724). The mly trigger
#    (ioctl MLYIO_COMMAND on /dev/mly0) is hardware-gated (no mly controller
#    in the guest); the sink executes the identical code path that
#    mly_user_command (mly.c:2891) would execute with DataTransferLength=INT_MIN.
# Guest reset to with-src afterwards; verified up (guest_dirty=0).

# Build-time confirmation (guest cc, -Werror):
# kmallocsink.c:46: error: argument 1 value '18446744071562067968' exceeds
#   maximum object size 9223372036854775807 [-Werror=alloc-size-larger-than=]
# (0xffffffff80000000 == the exact size mly.c:2889 computes for INT_MIN)