login: df4515mod: loaded (DF-4515/DF-4516 primitive driver)
df4515mod: [1] dma_buf_export ok dmabuf=0xfffff8008d602560 fp=0xfffff80116c48680 f_count=1 (falloc ref)
df4515mod: [2] dma_buf_fd -> fd=3 f_count=2 (falloc + fdtab refs)
df4515mod: [3] dma_buf_get err -9
df4515mod: [3] dma_buf_get err -9
df4515mod: loaded (DF-4515/DF-4516 primitive driver)
df4515mod: [5] H2F: dmabuf=0xfffff8004f145530 fp=0xfffff801167ece00 fd=3 f_count=2
df4515mod: [5] F2H lookup-hit cycle #1 done; f_count now 2
df4515mod: [5] F2H lookup-hit cycle #2 done; f_count now 1
df4515mod:   dma_buf_ops.release fired (dmabuf=0xfffff8004f145530)
df4515mod: [5] F2H lookup-hit cycle #3 done; f_count now 0  <== UNDERFLOW: file freed, fd still installed
df4515mod: [5] touching freed file via installed fd:
df4515mod: [5] survived UAF touch (dma_buf_get -> 0)
panic: fdrop: invalid f_count -1
cpuid = 0
Trace beginning at frame 0xfffff80118c43768
fdrop() at fdrop+0x10e 0xffffffff806314de 
fdrop() at fdrop+0x10e 0xffffffff806314de 
closef() at closef+0x32 0xffffffff80631f22 
fdfree() at fdfree+0x15e 0xffffffff8063351e 
exit1() at exit1+0x13f 0xffffffff8063f85f 
sys_exit() at sys_exit+0xe 0xffffffff8063fdfe 
Debugger("panic")

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>