inet6 fe80::5054:ff:fe12:3456%vtnet0 prefixlen 64 tentative scopeid 0x1
	media: Ethernet 1000baseT <full-duplex>
	status: active
route: writing to routing socket: File exists
add net default: gateway 10.0.2.2: File exists
Additional routing options:.
Starting devd.
Additional TCP options:.
Mounting NFS file systems:.
ELF ldconfig path: /lib /usr/lib /usr/local/lib /usr/local/libdata/ldconfig/pkg
Building databases...
Starting syslogd.
Sep 23 05:46:56 dfbsd syslogd: kernel boot file is /boot/kernel/kernel

No core dumps found.
swap low/high-water marks set to 41940/62910
swapon: adding /dev/vbd0s1b as swap device
NFS CLIENT: access_cache_timeout=5 neg_cache_timeout=3.
Starting local daemons:.
Updating motd.
Configuring syscons: blanktime.
Starting sshd.
sendmail_submit: /etc/mail/aliases.db not present,  generating
sendmail_clientmqueue: /etc/mail/aliases.db not present,  generating
Starting cron.
Local package initialization:.

Wed Sep 23 05:46:56 UTC 2026


DragonFly/x86_64 (dfbsd) (ttyd0)



login: <6>[drm] amdgpu kernel modesetting enabled.
[DF4740] module loaded: sysctl hw.df4740.test=1 (recovery UAF) or =2 (fini/TDR UAF)
Sep 23 05:47:29 dfbsd kernel: [drm] amdgpu kernel modesetting enabled.
[DF4740] test1 attempt 1: setup
[DF4740] run_job(victim): hold entered - recovery inside unlocked window (sched_main.c:368-369)
[DF4740] free_job(victim) job=0xfffff8008f8ecf80 s_fence=0xfffff8008d3cd800 - victim job FREED while recovery(B) sits inside run_job()
[DF4740] stagehand: victim freed; waiting 3s for drm-RCU delay-line free of s_fence 0xfffff8008d3cd800
[DF4740] stagehand: opening gate - recovery resumes into freed/reclaimed s_fence memory
[DF4740] run_job(victim): released; recovery now writes s_fence=0xfffff8008d3cd800 (freed=1) at sched_main.c:373-374
[DF4740] *** UAF CONFIRMED (stage 1): recovery armed cb 0xfffff8008d3cd8a0 (offset +0xa0) inside FREED s_fence 0xfffff8008d3cd800 (sched_main.c:374) ***
[DF4740] stage 1 complete: armed-cb-on-freed=1 heap-write=-1; now run 'sysctl hw.df4740.fire=1' to signal the recovery parent and use the freed object
[DF4740] FIRE: signalling recovery parent 0xfffff8008f8ed000 - drm_sched_process_job will run through cb inside freed s_fence 0xfffff8008d3cd800


Fatal trap 9: general protection fault while in kernel mode
cpuid = 1; lapic id = 1
instruction pointer	= 0x8:0xffffffff868218c0
stack pointer	        = 0x10:0xfffff8011c57b6f8
frame pointer	        = 0x10:0xfffff8011c57b748
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 988
current thread          = pri 6 (CRIT)
kernel: type 9 trap, code=0

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      dma_fence_signal_locked+0xb0:   ret
db>