DF-4311 baseline (UNPATCHED) run log — compiled from the live guest session
============================================================================
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026
       root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
       (dfbsd-qemu/vm.sh snapshot, QEMU std VGA, securelevel -1)

--- Phase 1: load victim + parser exercise (root) ------------------------
$ kldload vga_switcheroo                 -> kldload rc=0
$ ls -l /dev/vga_switcheroo              -> crw------- 1 root wheel (0600: root-only)
$ printf '%s' ON|OFF|IGD|DIS|DIGD|DDIS|MIGD|MDIS|GIBBERISH > /dev/vga_switcheroo
  every write returns error (-22 EINVAL: vgasr_priv->active is false because
  no handler/clients can ever register in this tree - all registration call
  sites are compiled out: i915_drv.c:683 #if 0, radeon_device.c #ifdef
  DUMBBELL_WIP, amdgpu_device.c:2522 #if 0)
  NO PANIC on any command; module never active.
$ cat /tmp/b255  > /dev/vga_switcheroo   -> rc: write error (EINVAL), no panic
$ cat /tmp/b1024 > /dev/vga_switcheroo   -> rc: write error (EINVAL), no panic
  (1024-byte write into the 256-byte staging buffer is truncated by
   amt = MIN(uio_resid, BUFFERSIZE - len); bounds hold empirically)
$ printf IGD > /dev/vga_switcheroo; printf MORE > /dev/vga_switcheroo
  -> append path (uio_offset == len) also returns EINVAL, no panic.
$ su -m nobody -c 'cat /tmp/b255 > /dev/vga_switcheroo'
  -> "/dev/vga_switcheroo: Permission denied."  (0600 root gate confirmed:
     the write parser is NOT reachable by unprivileged users)

--- Phase 2: cross-module caller (uaftrig.ko stands in for drm.ko) -------
$ kldload /root/uaftrig/uaftrig.ko       -> rc=0 (symbols resolved from vga_switcheroo.ko)
$ echo trigger > /dev/uaftrig            -> rc=0
  uaftrig: vga_switcheroo_lock_ddc(NULL) = -19      (-ENODEV, no handler)
  uaftrig: vga_switcheroo_unlock_ddc(NULL) = -19
  (identical to the drm_get_edid_switcheroo() call pattern, drm_edid.c:1770)

--- Phase 3: THE BUG — unload victim while dependent module is loaded ----
$ kldunload vga_switcheroo
  serial console: "vga_switcheroo device unloaded"    (unload SUCCEEDED —
  no dependency guard: kern_linker.c resolves cross-file symbols via global
  search without recording a dependency)
$ echo trigger-after-unload > /dev/uaftrig

--- Phase 4: result ------------------------------------------------------
  ssh session dies; vm.sh status -> down. Serial console (panic.txt):

  Fatal trap 12: page fault while in kernel mode
  cpuid = 5; lapic id = 5
  fault virtual address = 0xffffffff82601040
  fault code           = supervisor read instruction, page not present
  instruction pointer  = 0x8:0xffffffff82601040     <- INSIDE the unloaded
                                                        module's text range
  (vga_switcheroo.ko was mapped at 0xffffffff82600000, size 0x2000)
  kernel: type 12 trap, code=10
  -> CPUs stopped, db> prompt, guest down.

REPRODUCED: root-triggered use-after-unload; kernel panic.
Trigger privilege: kldunload requires root (securelevel -1 here; on a
production box securelevel >= 0 blocks kldunload entirely — the bug is
therefore a privileged-user/local-admin UAF, not an unpriv escalation).