df4106: dispatching REAL kernel handlers: vge_rxeof=0xffffffff808d2680 vge_newbuf=0xffffffff808d2480 vge_dma_map_addr=0xffffffff808d2dc0
df4106: === Phase 0: fabricate post-attach softc (vge_dma_alloc replay + MMIO stand-in) ===
df4106: ============ SCENARIO A: SOF failure, incomplete frame, vge_stop double free ============
df4106: A: ring initialized; m0=0xfffff80117635000 m1=0xfffff80117635200
Warning: objcache(mbuf pkthdr+cl) exhausted on cpu1!
df4106: drained 33570 mbuf clusters M-bM^@M^T m_getcl(M_NOWAIT) now FAILS (vge_newbuf ENOBUFS path armed)
df4106: A: dispatch 1 (REAL kernel vge_rxeof)
df4106: [A-after-dispatch1] head=0 tail=0 consumed=2 prodidx=2
df4106: [A-after-dispatch1] slot 0: sts=0000000000 own=0 rx_mbuf=0xfffff80117635000
df4106: [A-after-dispatch1] slot 1: sts=0000000000 own=0 rx_mbuf=0xfffff80117635200
df4106: [A-after-dispatch1] slot 2: sts=0x80000000 own=1 rx_mbuf=0xfffff80117635400
df4106: [A-after-dispatch1] slot 3: sts=0x80000000 own=1 rx_mbuf=0xfffff80117635600
df4106: *** A: DOUBLE-REFERENCE: head chain {} AND ring rx_mbuf[0]=0xfffff80117635000 rx_mbuf[1]=0xfffff80117635200 reference the same mbufs M-bM^@M^T the ignored vge_newbuf() failure at if_vge.c:1294 ***
df4106: A: dispatch 2 (ring wrap, REAL kernel vge_rxeof)
df4106: A: head chain now:
df4106: A: vge_stop tail (if_vge.c:2102-2125)
df4106: *** A2: DOUBLE FREE: m0=0xfffff80117635000 and m1=0xfffff80117635200 are passed to m_freem() twice M-bM^@M^T once in the head chain, once in the RX-list loop ***
df4106: vge_stop: m_freem(rx_mbuf[0]=0xfffff80117635000)
df4106: vge_stop: m_freem(rx_mbuf[1]=0xfffff80117635200)
df4106: vge_stop: m_freem(rx_mbuf[2]=0xfffff80117635400)
df4106: vge_stop: m_freem(rx_mbuf[3]=0xfffff80117635600)
df4106: A: releasing pool, alias scan
df4106: [A] NO ALIAS FOUND in 2200 allocations
df4106: ============ SCENARIO B: SOF failure on a completed jumbo, next-walk UAF/theft ============
df4106: B: ring initialized; m0=0xfffff80117635000 m1=0xfffff80117635200 m2=0xfffff80117635400
df4106: drained 33570 mbuf clusters M-bM^@M^T m_getcl(M_NOWAIT) now FAILS (vge_newbuf ENOBUFS path armed)
df4106: B: dispatch 1 (REAL kernel vge_rxeof)
df4106: [B-after-dispatch1] head=0 tail=0 consumed=3 prodidx=3
df4106: [B-after-dispatch1] slot 0: sts=0000000000 own=0 rx_mbuf=0xfffff80117635000
df4106: [B-after-dispatch1] slot 1: sts=0000000000 own=0 rx_mbuf=0xfffff80117635200
df4106: [B-after-dispatch1] slot 2: sts=0000000000 own=0 rx_mbuf=0xfffff80117635400
df4106: [B-after-dispatch1] slot 3: sts=0x80000000 own=1 rx_mbuf=0xfffff80117635600
df4106: *** B: the EOF branch (if_vge.c:1328-1337) m_freem()d the head chain {m0,m1} while the failed SOF newbufs left vge_rx_mbuf[0]=0xfffff80117635000 (==m0: YES) and rx_mbuf[1]=0xfffff80117635200 (==m1: YES) DANGLING in the ring ***
df4106: B: unrelated alloc 0 = 0xfffff8011da14000
df4106: B: unrelated alloc 1 = 0xfffff8011da14200
df4106: if_input(ifp,0xfffff80117635600) chain: [0xfffff80117635600 len=1496 fl=0xe003]
df4106: if_input(ifp,0xfffff80117635800) chain: [0xfffff80117635800 len=1496 fl=0xe003]
df4106: if_input(ifp,0xfffff80117635a00) chain: [0xfffff80117635a00 len=1496 fl=0xe003]
df4106: B: dispatch 2 (ring wrap over dangling entries, REAL kernel vge_rxeof)
df4106: [B-after-dispatch2] head=0 tail=0 consumed=2 prodidx=0
df4106: [B-after-dispatch2] slot 0: sts=0x80000000 own=1 rx_mbuf=0xfffff80117635000
df4106: [B-after-dispatch2] slot 1: sts=0x80000000 own=1 rx_mbuf=0xfffff80117635200
df4106: [B-after-dispatch2] slot 2: sts=0x17f48000 own=0 rx_mbuf=0xfffff80117635400
df4106: [B-after-dispatch2] slot 3: sts=0x80000000 own=1 rx_mbuf=0xfffff8011da14400
df4106: *** B1: unrelated alloc 0 (0xfffff8011da14000): m_len=0 m_flags=0xe003 M-bM^@M^T the REAL handler wrote through the dangling ring entry (untouched) ***
df4106: *** B1: unrelated alloc 1 (0xfffff8011da14200): m_len=0 m_flags=0xe003 M-bM^@M^T the REAL handler wrote through the dangling ring entry (untouched) ***
df4106: B: unexpected delivered-chain count 3 -> 3
df4106: vge_stop: m_freem(rx_mbuf[0]=0xfffff80117635000)
df4106: vge_stop: m_freem(rx_mbuf[1]=0xfffff80117635200)
df4106: vge_stop: m_freem(rx_mbuf[2]=0xfffff80117635400)
df4106: vge_stop: m_freem(rx_mbuf[3]=0xfffff8011da14400)
df4106: [B] NO ALIAS FOUND in 2200 allocations
df4106: SURVIVED (note: alias scan incomplete M-bM^@M^T see markers above)