df4080: DB PD_EQ_DB=0x20000400 — EQ0 doorbell ARMED (rearm=1)
df4080: [oce_detach ordering, oce_if.c:338-342] REAL ether_ifdetach + if_free — oce_hw_shutdown (intr disable) would only run AFTER the free
df4080: *** ifnet 0xfffff801186bd1c0 FREED by if_free() while interrupts are ENABLED and EQ0 ARMED; sc->ifp still points at it, exactly as oce_detach leaves it ***
df4080: freed ifnet (intact) if_input=0xffffffff82600050  ifi_ierrors=0  ifi_ipackets=0
df4080: slot reuse: kmalloc(M_IFNET, sizeof(arpcom)) = 0xfffff801186bd1c0 == THE FREED IFNET — the freed ifnet's memory is now OWNED by an unrelated allocation; its if_input is now 0
df4080: *** LATE async event: dispatching the REAL oce_intr(&ii, 1) (the taskqueue body, oce_if.c:553) — the interrupt path is still live on the FREED ifnet ***
df4080: after the late dispatch:
df4080:   sc->link_status=1 (LINK_UP) — REAL process_link_state ran post-free (oce_if.c:2058-2075)
df4080:   MQ CQE dw3 now 0000000000 (cleared => REAL oce_mq_handler consumed the async event, oce_if.c:2125)
df4080:   freed ifnet ifi_ierrors: 0 -> 0 (UAF WRITE through sc->ifp, oce_if.c:1606)
df4080:   freed ifnet ifi_ipackets: 0 -> 0 (UAF WRITE through sc->ifp, oce_if.c:1354)
df4080: *** the unrelated allocation at the freed ifnet's address now carries the corrupted counters: ifi_ierrors=0 ifi_ipackets=0 — cross-object corruption materialized ***
df4080:   chains delivered through the freed ifnet: 0
df4080: SURVIVED — post-free interrupt dispatch, UAF writes and UAF delivery all demonstrated above
df4080: dispatching REAL kernel oce_intr()=0xffffffff805c7590 and REAL cq handlers oce_mq_handler()=0xffffffff805c9fe0 oce_rq_handler()=0xffffffff805c9e50
dfoce0: driver didn't set altq_maxlen
dfoce0: MAC address: 00:11:22:33:44:55
df4080: [oce_if_deactivate tail, oce_if.c:2017-2018] REAL oce_hw_intr_enable + oce_arm_eq(eq0, rearm=TRUE)
df4080: CFG PCICFG_INTR_CTRL=0x20000000 -> HOSTINTR_MASK SET — interrupts ENABLED
df4080: DB PD_EQ_DB=0x20000400 — EQ0 doorbell ARMED (rearm=1)
df4080: [oce_detach ordering, oce_if.c:338-342] REAL ether_ifdetach + if_free — oce_hw_shutdown (intr disable) would only run AFTER the free
df4080: *** ifnet 0xfffff801186bd1c0 FREED by if_free() while interrupts are ENABLED and EQ0 ARMED; sc->ifp still points at it, exactly as oce_detach leaves it ***
df4080: freed ifnet (intact) if_input=0xffffffff82600050  ifi_ierrors=0  ifi_ipackets=0
df4080: slot reuse: kmalloc(M_IFNET, sizeof(arpcom)) = 0xfffff801186bd1c0 == THE FREED IFNET — the freed ifnet's memory is now OWNED by an unrelated allocation; its if_input is now 0
df4080: *** LATE async event: dispatching the REAL oce_intr(&ii, 1) (the taskqueue body, oce_if.c:553) — the interrupt path is still live on the FREED ifnet ***
Fatal user address access from kernel mode from sysctl at 0000000000000000


Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address	= 0x0
fault code		= supervisor read instruction, page not present
instruction pointer	= 0x8:0x0
stack pointer	        = 0x10:0xfffff80117873640
frame pointer	        = 0x10:0xfffff80117873698
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1210
current thread          = pri 10 
kernel: type 12 trap, code=10

CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      0:

Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address	= 0x0
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff80bccb70
stack pointer	        = 0x10:0xfffff801178732e0
frame pointer	        = 0x10:0xfffff80117873308
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1210
current thread          = pri 10 (CRIT)
      kernel: type 12 trap, code=0
db>