# DF-4240 baseline reproduction (captured live on the audit guest,
# unpatched X86_64_GENERIC #0 Thu Jul 2 06:02:54 UTC 2026).
# Production dpt_attach (0xffffffff80439500) dispatched by the rig over a
# fabricated post-dpt_init softc (real busdma; free list built by production
# dptallocccbs @ 0xffffffff804375e0).

=== controlled variant: device-fed channels=4 (MAX_CHAN=3) ===
$ ./dfdpt_ctl chan8 4
[chan8] channels=4 attach_ret=4 channels_after=4 canary_cp 0x41414141->0x8d481e20 canary_li 0x42424242->0xfffff800 path0_holds_sim=1 runaway=0
[chan8] slot[0] off=152 val=0xfffff8011751d500      <- &sims[3] == &paths[0]: cam_sim* overwrote paths[0]
[chan8] slot[3] off=176 val=0xfffff8008d481e20      <- &paths[3] == &commands_processed: cam_path* over both counters
[chan8] slot[4] off=184 val=0xf00000004             <- channels=4 / max_id=15 (softc fields)
[dptrig] CHAN8: softc2=... sizeof=9544 off(sims)=128 off(paths)=152 (&sims[3]-&paths[0]=0 bytes)
[dptrig] CHAN8: paths[0]=0xfffff8011751d500 vs sims[3]=0xfffff8011751d500 -> paths[0] holds a SIM pointer: YES (type confusion)

=== catastrophic variant: device-fed channels=8 (MAX_CHAN=7) ===
$ ./dfdpt_ctl chan8 8
# (serial console, guest dies -- full text in run_channels8_fault.log)
[dptrig] CHAN8: softc2=0xfffff801184e0000 sizeof=9544 off(sims)=128 off(paths)=152 (&sims[3]-&paths[0]=0 bytes)
[dptrig] CHAN8: channels=8 (MAX_CHAN=7) max_dccbs=64 -> PRODUCTION dpt_attach()

Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address = 0xfffff801184f3000
fault code = supervisor write data, page not present
instruction pointer = 0x8:0xffffffff802b0b5b
stack pointer = 0x10:0xfffff80117cb7678
current process = 870
kernel: type 12 trap, code=2
Stopped at xpt_create_path+0x6b: movq %rbx,(%r12)
# fault VA is 77,824 bytes past the softc start: the OOB store at &sims[7]
# (== &channels) corrupted the loop bound, production dpt_attach ran away
# writing cam_sim*/cam_path* pointers until it hit an unmapped page.

=== fix validation (patched kernel #1 Wed Oct 14 16:41:52 UTC 2026, all 3 fixes) ===
# device DMA-feeds MAX_CHAN=7 through the emulated EATA config handshake into
# PRODUCTION dpt_init (fullinit path), then production dpt_attach:
$ ./dfdpt_ctl fullinit 8
[dptrig] vhba: DMA'd config page 0xc1, MAX_CHAN=7
[dptrig] vhba: handshake complete (inquiry released)
dpt7:   FW Rev. , 3 channels, 16 CCBs
[dptrig] FULLINIT: dpt_init()=0 channels=3 (device said MAX_CHAN+1=8)  [clamped to MAX_CHANNELS]
[dptrig] FULLINIT: attach_ret=3 channels=8 canary cp 0x41414141->0x41414141 li 0x42424242->0x42424242 runaway=0
#   ^ "channels=8" in that line is the ctl's input echo; channels_after=3 is authoritative:
[fullinit] maxchan+1=8 attach_ret=3 channels_after=3 canary_cp 0x41414141->0x41414141 canary_li 0x42424242->0x42424242 path0_holds_sim=1 runaway=0
[fullinit] slot[3] off=176 val=0x4242424241414141   <- canaries INTACT (no store at &paths[3])
[fullinit] slot[4] off=184 val=0xf00000003          <- channels=3, max_id=15 (own fields)