=== step -1: pre-clean stale vkbd children from kbdmux ===
=== step 0: create fresh vkbd keyboard (hold /dev/vkbdctl open) ===
2a3
> /dev/kbd2
victim cdev: /dev/kbd2 (index 2)
=== step 0b: release the vkbd child from kbdmux (else EBUSY) ===
kbdrel(vkbd31): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd30): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd29): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd28): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd27): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd26): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd25): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd24): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd23): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd22): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd21): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd20): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd19): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd18): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd17): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd16): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd15): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd14): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd13): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd12): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd11): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd10): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd9): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd8): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd7): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd6): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd5): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd4): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd3): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd2): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd1): ioctl KBRELKBD -> -1 errno=6 (Device not configured)
kbdrel(vkbd0): ioctl KBRELKBD -> 0 errno=0 (Undefined error: 0)
/dev/kbd2: open OK, read -> -1 errno=35 (Resource temporarily unavailable)
=== step 1: victim reader blocks in genkbdread tsleep kbdrea on /dev/kbd2 ===
   PID STAT   WCHAN    COMMAND
  1157 S0     kbdrea   ./kbd_uaf
=== step 2: kbd_detach(index=2), one sysctl ===
hw.kbdkill.run: 0 -> 0
=== step 3: reader STILL blocked in kbdrea (wakeup never delivered) ===
   PID STAT   WCHAN    COMMAND
reader gone
=== step 3b: snapshot gkb_flags at the freed genkbd_softc ===
hw.kbdkill.snap: 0 -> 0
=== step 4: SIGUSR1 the reader -> sc->gkb_flags &= ~KB_ASLEEP on freed sc ===
kbd_uaf reader: read(2) returned -1 errno=6 (Device not configured)
=== step 5a: re-read gkb_flags at the freed sc (write-after-free) ===
hw.kbdkill.check2: 0 -> 0
=== step 5a: re-read gkb_flags at the freed sc (write-after-free) ===
hw.kbdkill.check2: 0 -> 0
=== step 6: holder close -> kbd_unregister -> KBDIO_UNLOADING ->
           genkbd_event KNOTE() on the FREED sc klist (kbd.c:905)
           EXPECT: fatal trap / panic
still alive (no panic)
HAMMER2: INITIATE SPANs
swap low/high-water marks set to 41940/62910
kbdkill: loaded (DF-4297 PoC helper)
kbd2 at vkbd0
kbdkill: run: before kbd_detach: kbd2 (vkbd0) si_drv1=0xfffff8008bb94280 gkb_flags=0x00000001
kbdkill: run: kbd_detach done - genkbd_softc freed at 0xfffff8008bb94280 (reader still blocked in genkbdread holds this pointer)
kbdkill: run: kbd_detach done; groomed 256 x 536 chunks (first @ 0xfffff8008bb94280)
kbdkill: snap: freed sc gkb_flags = 0x55555555 (pre-signal)
kbdkill: check2: freed sc gkb_flags now 0x55555555 (v0=0x00000001 pre-free, v1=0x55555555 pre-signal)
kbdkill: freed sc content unchanged - stale write did not manifest this run
kbdkill: check2: freed sc gkb_flags now 0x55555555 (v0=0x00000001 pre-free, v1=0x55555555 pre-signal)
kbdkill: freed sc content unchanged - stale write did not manifest this run
=== guest still alive:
DragonFly 6.5-DEVELOPMENT #1: Sat Sep 19 06:32:43 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC