=== DF-4132 crash #1 (first boot, guest dfbsd 6.5-DEVELOPMENT X86_64_GENERIC) ===
Sep 18 03:44:12 dfbsd kernel: vinumioctl: invalid ioctl from process 979 (vinum_tokensmash): 40906468

Fatal trap 1: privileged instruction fault while in kernel mode
cpuid = 0; lapic id = 0
instruction pointer	= 0x8:0xfffff8008db3d4c3
stack pointer	        = 0x10:0xfffff8008db3d4bf
frame pointer	        = 0x10:0xfffff8008db3d4b9
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 992
current thread          = pri 6 
kernel: type 1 trap, code=0

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      -0x7ff724c2b3d: popal

Notes:
 * RIP 0xfffff8008db3d4c3 is NOT in kernel text (kernel+modules are mapped
   at 0xffffffff8xxxxxxx); it is the address of the kmalloc(1024) ioctl
   buffer that sys_ioctl (sys/kern/sys_generic.c:675) allocated for the
   VINUM_CREATE call and that tokenize() filled with our tokens.
 * The faulting instruction decodes as "popal" because 0x61 == 'a' --
   the byte value of every token in the overflowing config line.
   The kernel jumped into the attacker-supplied buffer and executed it:
   the overflow had replaced the saved RIP of the command_fail jmp_buf
   (vinumioctl.c:61, .bss) with a pointer written by tokenize().
 * crash #2 (fresh boot, same binary): identical signature,
   RIP 0xfffff8008eddb8c3, process 908 (vinum_tokensmash).