=================================================================
DF-3981 mechanism verification - DragonFly 6.5-DEVELOPMENT guest
(guest reset with-src before this run; same sources as audit tree)
=================================================================
$ kldload /root/kmod/sbpprep.ko && echo KLD_OK; sysctl kern.sbpprep_a=1; sleep 4; dmesg | grep "sbpprep\[A\]" | tail -3
KLD_OK
kern.sbpprep_a: 0 -> 0
sbpprep[A]: armed login_callout in 0xfffff80117817880, tick=3940
sbpprep[A]: kfree(0xfffff80117817880) DONE - callout still armed, no callout_stop() (sbp.c:1978 has none)
sbpprep[A]: login_callout FIRED on FREED object 0xfffff80117817880 (arg == freed pointer: YES)

[earlier identical run on pre-reset guest]
sbpprep[A]: armed login_callout in 0xfffff8008bb64460, tick=148373
sbpprep[A]: kfree(0xfffff8008bb64460) DONE - callout still armed, no callout_stop() (sbp.c:1978 has none)
sbpprep[A]: login_callout FIRED on FREED object 0xfffff8008bb64460 (arg == freed pointer: YES)

INTERPRETATION:
 The DragonFly callout subsystem executes the callback (and post-processes
 the embedded `struct callout`, i.e. writes into the freed slab) after the
 container is kfree'd without callout_stop() -- twice, on two boots.
 The real sbp_login_callout (sbp.c:625-629) passes that freed pointer
 straight into sbp_mgm_orb(), which reads sdev->target, walks
 sdev->free_ocbs, and writes ocb->orb[0..7] into fwdma_free'd pages:
 kernel heap use-after-free read+write.
 The end-to-end sbp trigger needs FireWire+SBP hardware (absent in guest:
 pciconf shows no OHCI-1394 device) -> end-to-end status: inconclusive;
 mechanism: reproduced twice.