# fix validation logs (session-captured; guest serial + command outputs)
# Baseline kernel: #0 Thu Jul 2 06:02:54 UTC 2026 (stock audit image)
# Fix kernel v1:   build-2, linked 05:27:51, installed 05:38, md5(/boot/kernel/kernel)==md5(kernel.debug) verified
# Fix kernel v2:   build-3, linked 05:59:48, installed 06:07 (after deleting 0-byte .ko debris from a killed install)

== BASELINE (unfixed) — reproduced 2/2, deterministic ==================
[run 1] 6+ spammers; first driver-detach under load:
  Fatal trap 18: integer divide fault while in kernel mode
  instruction pointer = 0x8:0xffffffff80310904
  current process = 934 (spammer)
  Stopped at nvme_get_request+0x34: divl 0x40(%r13),%eax     [see panic.txt]
[run 2] fresh boot, rc.local spammers, first detach:
  identical trap, current process = 633                      [see panic.txt]

== FIX KERNEL v1 (build-2) — div0 GONE on identical rig ==============
  # kldload nvmebang.ko; sysctl hw.nvmebang.action=1
  nvmebang: DETACH method on nvme0...
  nvme0: Normal chip shutdown succeeded
  nvmebang: DETACH method done error=0
  SURVIVED_DETACH (no Fatal trap; spammers continue: n=88047 errs=0)
  => the reproduced nvme_get_request div0 panic is eliminated.

== FIX KERNEL v1, aggressive 6x attach/detach cycling ===============
  stress beyond the demonstrated bug (raw attach/detach method calls,
  emulating repeated hotplug cycles):
  Fatal trap 12 at nvme_open+0x13: testb $0x2,0x44c(%rdx)
  [see panic.open.txt] -> same softns-lifetime class via the OPEN path;
  motivated fix v2 (si_drv1 NULL + entry guards).

== FIX KERNEL v2 (build-3) ===========================================
  [rig error first] attach invoked on already-attached device ->
    panic: MSI-X has been setup yet @ pci_setup_msix <- nvme_pci_attach
    (expected: raw method call bypasses newbus probe/attach state guard;
     a real rescan cannot do this; not a driver defect)
  [corrected rig, fresh boot] first detach under load:
    Stopped at nvme_ioctl+0xe: movq (%rdx),%rdi              [see residual_fault.txt]
  => the getlog div0 remains eliminated, but teardown-window dispatch
     through a zombie cdev can still fault one instruction earlier
     (reading nsc->sc through a stale si_drv1). The complete fix for the
     device-lifetime class requires refcounting softns per open
     descriptor (upstream-grade); fix.diff closes every demonstrated
     RIP and hardens all dispatch entries, but is explicitly partial
     for the residual zombie-dispatch race.

== KERNEL BUILD (fix) ================================================
  >>> Kernel build for X86_64_GENERIC started on Mon Sep 21 05:56:00 UTC 2026
  >>> Kernel build for X86_64_GENERIC completed on Mon Sep 21 06:05:04 UTC 2026
  >>> Kernel install for X86_64_GENERIC completed on Mon Sep 21 06:07:53 UTC 2026
  (0 compiler errors/-Werror build; symbols verified: nvme_pci_detach
   moved 0xffffffff80311920 -> 0xffffffff80311bc0 = patched code linked;
   runtime kernel verified by md5(/boot/kernel/kernel) == md5(kernel.debug))