# BASELINE (stock kernel: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026)
# Command (guest, root): cd /root/poc && ./ata_timeout_uaf 32 600 -1
# Guest PANICKED ~12s into the run (ssh died, vm.sh status => down).
# Userland log was lost with the guest; the decisive evidence is the
# serial console capture (serial_a1_panic.log), which contains:
#   - 107 x "acd0: WARNING - TEST_UNIT_READY taskqueue timeout - completing request directly"
#   - Fatal trap 12 in ata_start+0x1da (cmpq (%rax),%r14, fault address 0x0)
#   - "Fatal user address access from kernel mode from ata_timeout_uaf"
# Extract (see serial_a1_panic.log for the full capture):
acd0: WARNING - TEST_UNIT_READY taskqueue timeout - completing request directly
Fatal user address access from kernel mode from ata_timeout_uaf at ffffffff8032f7ea
Fatal trap 12: page fault while in kernel mode
cpuid = 3; lapic id = 3
fault virtual address	= 0x0
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff8032f7ea
current process		= 917
Stopped at      ata_start+0x1da:        cmpq    (%rax),%r14
db>