⬢ DragonFlyBSD Kernel Audit
DF-4636 / run.log
← back to finding ↓ download raw 
SRC-SHA-OK  794cb6c29cb9e9fd17d4c826e86389ecb44a778e1f80ace15f7cc3e1a3410cb1
HDR-SHA-OK  e177532a3afbe84ab4d15060b2b0f21e83e3080e5c4607c8f7afc004d4513b23
FIX-APPLIED-CLEAN
EXTRACTED base=     258 lines fixed=     301 lines
BUILD baseline:
h_base.c:372:12: warning: 'radeon_atif_get_notification_params' defined but not used [-Wunused-function]
 static int radeon_atif_get_notification_params(ACPI_HANDLE handle,
            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
BUILD fixed:
h_fixed.c:384:12: warning: 'radeon_atif_get_notification_params' defined but not used [-Wunused-function]
 static int radeon_atif_get_notification_params(ACPI_HANDLE handle,
            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-rwxr-xr-x  1 root  wheel  12968 Sep 22 11:00 h_base
-rwxr-xr-x  1 root  wheel  14032 Sep 22 11:00 h_fixed

================ BASELINE (shipped kernel source) ================
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
  >>> FAULT SIGSEGV si_addr=0x414141414100
  >>> FAULT SIGSEGV si_addr=0x424242424200
  >>> FAULT SIGSEGV si_addr=0x0
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  >>> FAULT SIGSEGV si_addr=0x414141414100
  >>> FAULT SIGSEGV si_addr=0x424242424200
  >>> FAULT SIGSEGV si_addr=0x0
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  >>> FAULT SIGSEGV si_addr=0x414141414100
  >>> FAULT SIGSEGV si_addr=0x424242424200
  >>> FAULT SIGSEGV si_addr=0x0
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  >>> FAULT SIGSEGV si_addr=0x414141414100
  >>> FAULT SIGSEGV si_addr=0x424242424200
  >>> FAULT SIGSEGV si_addr=0x0
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
== DF-4636 harness (BASELINE variant) ==
offsetof(Integer.Value)=8 offsetof(Buffer.Pointer)=8 (union aliasing: YES)
  RESULT control_wellformed: child exit=0
  RESULT control_wellformed: child exit=0
  RESULT control_wellformed: child exit=0
  RESULT control_wellformed: child exit=0
control_wellformed: 4/4 returned cleanly

  RESULT integer_wild_atif: child exit=77
  RESULT integer_wild_atcs: child exit=77
  RESULT null_buffer: child exit=77
  RESULT shortbuf_hdr: child exit=77
  RESULT lying_size: child exit=77
  RESULT integer_wild_atif: child exit=77
  RESULT integer_wild_atcs: child exit=77
  RESULT null_buffer: child exit=77
  RESULT shortbuf_hdr: child exit=77
  RESULT lying_size: child exit=77
  RESULT integer_wild_atif: child exit=77
  RESULT integer_wild_atcs: child exit=77
  RESULT null_buffer: child exit=77
  RESULT shortbuf_hdr: child exit=77
  RESULT lying_size: child exit=77
  RESULT integer_wild_atif: child exit=77
  RESULT integer_wild_atcs: child exit=77
  RESULT null_buffer: child exit=77
  RESULT shortbuf_hdr: child exit=77
  RESULT lying_size: child exit=77
fault fixtures: 4/4 iterations with ALL 5 fixtures faulting
PROOF-RESULT: BASELINE-CORRUPTS (5/5 fixtures SIGSEGV 4/4 iterations, control parses)

================ FIXED (fix.diff applied) ================
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 1, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATCS returned an invalid object (type 1, length 0)
  radeon_atcs_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 3, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
[DRM_INFO] ATIF returned an invalid object (type 3, length 1)
  radeon_atif_get_sbios_requests -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
[DRM_INFO] ATIF buffer is too small: 12
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 1, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATCS returned an invalid object (type 1, length 0)
  radeon_atcs_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 3, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
[DRM_INFO] ATIF returned an invalid object (type 3, length 1)
  radeon_atif_get_sbios_requests -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
[DRM_INFO] ATIF buffer is too small: 12
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 1, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATCS returned an invalid object (type 1, length 0)
  radeon_atcs_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 3, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
[DRM_INFO] ATIF returned an invalid object (type 3, length 1)
  radeon_atif_get_sbios_requests -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
[DRM_INFO] ATIF buffer is too small: 12
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 1, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATCS returned an invalid object (type 1, length 0)
  radeon_atcs_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 3, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
[DRM_INFO] ATIF returned an invalid object (type 3, length 1)
  radeon_atif_get_sbios_requests -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
[DRM_INFO] ATIF buffer is too small: 12
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
== DF-4636 harness (FIXED variant) ==
offsetof(Integer.Value)=8 offsetof(Buffer.Pointer)=8 (union aliasing: YES)
  RESULT control_wellformed: child exit=0
  RESULT control_wellformed: child exit=0
  RESULT control_wellformed: child exit=0
  RESULT control_wellformed: child exit=0
control_wellformed: 4/4 returned cleanly

  RESULT integer_wild_atif: child exit=0
  RESULT integer_wild_atcs: child exit=0
  RESULT null_buffer: child exit=0
  RESULT shortbuf_hdr: child exit=0
  RESULT lying_size: child exit=0
  RESULT integer_wild_atif: child exit=0
  RESULT integer_wild_atcs: child exit=0
  RESULT null_buffer: child exit=0
  RESULT shortbuf_hdr: child exit=0
  RESULT lying_size: child exit=0
  RESULT integer_wild_atif: child exit=0
  RESULT integer_wild_atcs: child exit=0
  RESULT null_buffer: child exit=0
  RESULT shortbuf_hdr: child exit=0
  RESULT lying_size: child exit=0
  RESULT integer_wild_atif: child exit=0
  RESULT integer_wild_atcs: child exit=0
  RESULT null_buffer: child exit=0
  RESULT shortbuf_hdr: child exit=0
  RESULT lying_size: child exit=0
fault fixtures: 0/4 iterations with ALL 5 fixtures faulting
PROOF-RESULT: FIXED-CLEAN (no faults, control still parses)

================ REPEATS (stress, 3 more full rounds) ================
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
  >>> FAULT SIGSEGV si_addr=0x414141414100
  >>> FAULT SIGSEGV si_addr=0x424242424200
  >>> FAULT SIGSEGV si_addr=0x0
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  >>> FAULT SIGSEGV si_addr=0x414141414100
  >>> FAULT SIGSEGV si_addr=0x424242424200
  >>> FAULT SIGSEGV si_addr=0x0
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  >>> FAULT SIGSEGV si_addr=0x414141414100
  >>> FAULT SIGSEGV si_addr=0x424242424200
  >>> FAULT SIGSEGV si_addr=0x0
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  >>> FAULT SIGSEGV si_addr=0x414141414100
  >>> FAULT SIGSEGV si_addr=0x424242424200
  >>> FAULT SIGSEGV si_addr=0x0
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
fault fixtures: 4/4 iterations with ALL 5 fixtures faulting
PROOF-RESULT: BASELINE-CORRUPTS (5/5 fixtures SIGSEGV 4/4 iterations, control parses)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 1, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATCS returned an invalid object (type 1, length 0)
  radeon_atcs_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 3, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
[DRM_INFO] ATIF returned an invalid object (type 3, length 1)
  radeon_atif_get_sbios_requests -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
[DRM_INFO] ATIF buffer is too small: 12
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 1, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATCS returned an invalid object (type 1, length 0)
  radeon_atcs_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 3, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
[DRM_INFO] ATIF returned an invalid object (type 3, length 1)
  radeon_atif_get_sbios_requests -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
[DRM_INFO] ATIF buffer is too small: 12
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 1, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATCS returned an invalid object (type 1, length 0)
  radeon_atcs_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 3, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
[DRM_INFO] ATIF returned an invalid object (type 3, length 1)
  radeon_atif_get_sbios_requests -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
[DRM_INFO] ATIF buffer is too small: 12
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 1, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATCS returned an invalid object (type 1, length 0)
  radeon_atcs_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 3, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
[DRM_INFO] ATIF returned an invalid object (type 3, length 1)
  radeon_atif_get_sbios_requests -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
[DRM_INFO] ATIF buffer is too small: 12
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
fault fixtures: 0/4 iterations with ALL 5 fixtures faulting
PROOF-RESULT: FIXED-CLEAN (no faults, control still parses)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
  >>> FAULT SIGSEGV si_addr=0x414141414100
  >>> FAULT SIGSEGV si_addr=0x424242424200
  >>> FAULT SIGSEGV si_addr=0x0
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  >>> FAULT SIGSEGV si_addr=0x414141414100
  >>> FAULT SIGSEGV si_addr=0x424242424200
  >>> FAULT SIGSEGV si_addr=0x0
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  >>> FAULT SIGSEGV si_addr=0x414141414100
  >>> FAULT SIGSEGV si_addr=0x424242424200
  >>> FAULT SIGSEGV si_addr=0x0
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  >>> FAULT SIGSEGV si_addr=0x414141414100
  >>> FAULT SIGSEGV si_addr=0x424242424200
  >>> FAULT SIGSEGV si_addr=0x0
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
fault fixtures: 4/4 iterations with ALL 5 fixtures faulting
PROOF-RESULT: BASELINE-CORRUPTS (5/5 fixtures SIGSEGV 4/4 iterations, control parses)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 1, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATCS returned an invalid object (type 1, length 0)
  radeon_atcs_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 3, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
[DRM_INFO] ATIF returned an invalid object (type 3, length 1)
  radeon_atif_get_sbios_requests -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
[DRM_INFO] ATIF buffer is too small: 12
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 1, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATCS returned an invalid object (type 1, length 0)
  radeon_atcs_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 3, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
[DRM_INFO] ATIF returned an invalid object (type 3, length 1)
  radeon_atif_get_sbios_requests -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
[DRM_INFO] ATIF buffer is too small: 12
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 1, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATCS returned an invalid object (type 1, length 0)
  radeon_atcs_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 3, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
[DRM_INFO] ATIF returned an invalid object (type 3, length 1)
  radeon_atif_get_sbios_requests -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
[DRM_INFO] ATIF buffer is too small: 12
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 1, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATCS returned an invalid object (type 1, length 0)
  radeon_atcs_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 3, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
[DRM_INFO] ATIF returned an invalid object (type 3, length 1)
  radeon_atif_get_sbios_requests -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
[DRM_INFO] ATIF buffer is too small: 12
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
fault fixtures: 0/4 iterations with ALL 5 fixtures faulting
PROOF-RESULT: FIXED-CLEAN (no faults, control still parses)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
  >>> FAULT SIGSEGV si_addr=0x414141414100
  >>> FAULT SIGSEGV si_addr=0x424242424200
  >>> FAULT SIGSEGV si_addr=0x0
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  >>> FAULT SIGSEGV si_addr=0x414141414100
  >>> FAULT SIGSEGV si_addr=0x424242424200
  >>> FAULT SIGSEGV si_addr=0x0
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  >>> FAULT SIGSEGV si_addr=0x414141414100
  >>> FAULT SIGSEGV si_addr=0x424242424200
  >>> FAULT SIGSEGV si_addr=0x0
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  >>> FAULT SIGSEGV si_addr=0x414141414100
  >>> FAULT SIGSEGV si_addr=0x424242424200
  >>> FAULT SIGSEGV si_addr=0x0
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
  >>> FAULT SIGSEGV si_addr=0x80047d000
fault fixtures: 4/4 iterations with ALL 5 fixtures faulting
PROOF-RESULT: BASELINE-CORRUPTS (5/5 fixtures SIGSEGV 4/4 iterations, control parses)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRMDBG ] ATIF version 1
  radeon_atif_verify_interface -> 0 (expect 0, control)
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 1, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATCS returned an invalid object (type 1, length 0)
  radeon_atcs_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 3, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
[DRM_INFO] ATIF returned an invalid object (type 3, length 1)
  radeon_atif_get_sbios_requests -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
[DRM_INFO] ATIF buffer is too small: 12
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 1, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATCS returned an invalid object (type 1, length 0)
  radeon_atcs_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 3, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
[DRM_INFO] ATIF returned an invalid object (type 3, length 1)
  radeon_atif_get_sbios_requests -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
[DRM_INFO] ATIF buffer is too small: 12
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 1, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATCS returned an invalid object (type 1, length 0)
  radeon_atcs_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 3, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
[DRM_INFO] ATIF returned an invalid object (type 3, length 1)
  radeon_atif_get_sbios_requests -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
[DRM_INFO] ATIF buffer is too small: 12
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 1, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATCS returned an invalid object (type 1, length 0)
  radeon_atcs_verify_interface -> -22
  child returned normally (NO FAULT)
[DRM_INFO] ATIF returned an invalid object (type 3, length 0)
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cfff mapped_end=0x80047d000 (u16 size read spans 0x80047cfff..0x80047d000)
[DRM_INFO] ATIF returned an invalid object (type 3, length 1)
  radeon_atif_get_sbios_requests -> -22
  child returned normally (NO FAULT)
  buffer=0x80047cffc mapped_end=0x80047d000 (memcpy of min(12,12)=12 spans past 0x80047d000)
[DRM_INFO] ATIF buffer is too small: 12
  radeon_atif_verify_interface -> -22
  child returned normally (NO FAULT)
fault fixtures: 0/4 iterations with ALL 5 fixtures faulting
PROOF-RESULT: FIXED-CLEAN (no faults, control still parses)
DONE-WORKDIR=/tmp/df4636.6Z7zbl