DF-4506 run log — guest DragonFly 6.5-DEVELOPMENT (X86_64_GENERIC, amplifier build #1,
kernel "Sun Sep 20 22:50:41 UTC 2026")

$ kldload /root/idr_race/idr_race.ko
DF-4506: idr_race loaded (probe id 200, old array 4080 bytes)

== PHASE 1: amplified race (debug.idr_find_pause=3) ==================

$ sysctl debug.idr_find_pause=3
debug.idr_find_pause: 0 -> 3
$ sysctl debug.idr_race.run=20
DF-4506: run 20 iterations (orchestrated/amplified)
DF-4506: CAPTURE: idr_find returned 0xaaaaaaaaaaaaaaaa from freed+reused node array
        (x20 — every orchestrated round captured; serial console shows one line each)
DF-4506: done: iterations=20 finds=20 captures=20 anomalies=0

(repeat after guest reboot, run=10)
DF-4506: run 10 iterations (orchestrated/amplified)
DF-4506: CAPTURE ... (x9)
DF-4506: done: iterations=10 finds=10 captures=9 anomalies=0

Interpretation: the lockless idr_find() returned a pointer crafted by the
producer's canary re-allocation of the kfree()d node array — a fully
attacker-influenced "struct i915_gem_context *" in the real ioctl paths.

== PHASE 2: native-window stress (NO amplifier, debug.idr_find_pause=0) ==

$ sysctl debug.idr_find_pause=0
$ sysctl debug.idr_race.run=-500
DF-4506: run 500 iterations (NATIVE window stress)
DF-4506: done: iterations=500 finds=10 captures=9 anomalies=0
        (reader thread starved by the non-yielding producer this round; no new finds)

$ sysctl debug.idr_race.run=-500
DF-4506: run 500 iterations (NATIVE window stress)
(concurrent reader hits the window)

Fatal trap 12: page fault while in kernel mode
cpuid = 5; lapic id = 5
fault virtual address    = 0xc88
fault code               = supervisor read data, page not present
instruction pointer      = 0x8:0xffffffff809d5a88
stack pointer            = 0x10:0xfffff80117e43a70
current process          = Idle
kernel: type 12 trap, code=0
Stopped at      idr_find+0x48:  movl    0x8(%rbx),%edx
db>

0xc88 == 0x8 + 200*sizeof(struct idr_node)  ->  nodes[200].allocated
with %rbx a stale idr_nodes pointer.  Kernel PANIC from the unamplified,
unsynchronized idr_find() — full dump in panic.txt.

== PHASE 3: fix validation — see run.fixed.log ========================