== model: buggy unload, freed slot re-groomed by attacker chunk ==
[reuse] buggy midi_unload(): TAILQ_FOREACH + free-in-body
  unload: visiting unit 0 (0x8004904c0)
    [groom] freed slot reoccupied; forged link.tqe_next = 0x414141414140
[reuse] signal 11 at 0x414141414150 -- unload loop dereferenced the value read from FREED memory (kernel: UAF read in TAILQ_FOREACH advance; lockmgr(&m->lock) on attacker-chosen pointer)
exit=99
== model: buggy unload, plain free (stale allocator contents) ==
[stale] buggy midi_unload(): TAILQ_FOREACH + free-in-body
  unload: visiting unit 0 (0x8004904c0)
  unload: visiting unit 1 (0x8004904a0)
  unload: visiting unit 2 (0x800490480)
[stale] NOT REACHED: unload returned
exit=1
== model: fixed unload (stash next before destroy) ==
[fixed] fixed midi_unload(): stash next before destroy
  unload: visiting unit 0 (0x8004904c0)
  unload: visiting unit 1 (0x8004904a0)
  unload: visiting unit 2 (0x800490480)
[fixed] clean: all devices destroyed, no UAF
exit=0