vge_rxeof=0xffffffff808d2680 vge_newbuf=0xffffffff808d2480 vge_dma_map_addr=0xffffffff808d2d60
kern.df4106.rxeof: 0x0000000000000000 -> 0xffffffff808d2680
kern.df4106.newbuf: 0x0000000000000000 -> 0xffffffff808d2480
kern.df4106.mapaddr: 0x0000000000000000 -> 0xffffffff808d2d60
=== go: mode baseline (dispatching the running kernel's own vge_rxeof) ===
kern.df4106.go: 0 -> 0
GO_RC=0
UNLOAD_OK
df4106: vge_stop: m_freem(rx_mbuf[2]=0xfffff8011eae9000)
df4106: vge_stop: m_freem(rx_mbuf[3]=0xfffff8011eae8c00)
df4106: *** [B] ALIAS CONFIRMED: allocations #1184 and #1246 returned the SAME mbuf 0xfffff8011e423000 (cluster 0xfffff8011d8de800) M-bM^@M^T one kernel object with two live owners (double free materialized) ***
df4106: [B] 2 aliased allocation(s) found
df4106: SURVIVED M-bM^@M^T double-reference, double-queued chain, double free, dangling-entry UAF/theft all demonstrated above