df4080: dispatching REAL kernel oce_intr()=0xffffffff805c7590 and REAL cq handlers oce_mq_handler()=0xffffffff805ca010 oce_rq_handler()=0xffffffff805c9e80
dfoce0: driver didn't set altq_maxlen
dfoce0: MAC address: 00:11:22:33:44:55
df4080: [oce_if_deactivate tail, oce_if.c:2017-2018] REAL oce_hw_intr_enable + oce_arm_eq(eq0, rearm=TRUE)
df4080: CFG PCICFG_INTR_CTRL=0x20000000 -> HOSTINTR_MASK SET M-bM^@M^T interrupts ENABLED
df4080: DB PD_EQ_DB=0x20000400 M-bM^@M^T EQ0 doorbell ARMED (rearm=1)
df4080: [oce_detach ordering, oce_if.c:338-342] REAL ether_ifdetach + if_free M-bM^@M^T oce_hw_shutdown (intr disable) would only run AFTER the free
df4080: *** ifnet 0xfffff8008fa5e480 FREED by if_free() while interrupts are ENABLED and EQ0 ARMED; sc->ifp still points at it, exactly as oce_detach leaves it ***
df4080: freed ifnet (intact) if_input=0xffffffff82600050  ifi_ierrors=0  ifi_ipackets=0
df4080: *** LATE async event: dispatching the REAL oce_intr(&ii, 1) (the taskqueue body, oce_if.c:553) M-bM^@M^T the interrupt path is still live on the FREED ifnet ***
df4080: *** chain DELIVERED to if_input through ifp=0xfffff8008fa5e480 (the FREED ifnet) M-bM^@M^T REAL oce_rx dispatched a packet on a freed ifnet (oce_if.c:1373) ***
df4080: after the late dispatch:
df4080:   sc->link_status=1 (LINK_UP) M-bM^@M^T REAL process_link_state ran post-free (oce_if.c:2058-2075)
df4080:   MQ CQE dw3 now 0000000000 (cleared => REAL oce_mq_handler consumed the async event, oce_if.c:2125)
df4080:   freed ifnet ifi_ierrors: 0 -> 1 (UAF WRITE through sc->ifp, oce_if.c:1606)
df4080:   freed ifnet ifi_ipackets: 0 -> 1 (UAF WRITE through sc->ifp, oce_if.c:1354)
df4080:   chains delivered through the freed ifnet: 1
df4080: slot-reuse probe AFTER the dispatch: kmalloc(M_IFNET, sizeof(arpcom)) = 0xfffff8008fa5e480 == THE FREED IFNET (the slot is immediately reusable: every UAF write above landed in memory that now belongs to whoever allocates next)
df4080: SURVIVED M-bM^@M^T post-free interrupt dispatch, UAF writes and UAF delivery all demonstrated above