options=43 inet 127.0.0.1 netmask 0xff000000 inet6 ::1 prefixlen 128 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2 groups: lo vtnet0: flags=808843 metric 0 mtu 1500 options=28 ether 52:54:00:12:34:56 inet6 fe80::5054:ff:fe12:3456%vtnet0 prefixlen 64 tentative scopeid 0x1 media: Ethernet 1000baseT status: active add net default: gateway 10.0.2.2 Additional routing options:. Starting devd. Additional TCP options:. Mounting NFS file systems:. ELF ldconfig path: /lib /usr/lib /usr/local/lib /usr/local/libdata/ldconfig/pkg Building databases... Starting syslogd. Sep 23 05:54:53 dfbsd syslogd: kernel boot file is /boot/kernel/kernel No core dumps found. swap low/high-water marks set to 41940/62910 swapon: adding /dev/vbd0s1b as swap device NFS CLIENT: access_cache_timeout=5 neg_cache_timeout=3. Starting local daemons:. Updating motd. Configuring syscons: blanktime. Starting sshd. sendmail_submit: /etc/mail/aliases.db not present, generating sendmail_clientmqueue: /etc/mail/aliases.db not present, generating Starting cron. Local package initialization:. Wed Sep 23 05:54:53 UTC 2026 DragonFly/x86_64 (dfbsd) (ttyd0) login: <6>[drm] amdgpu kernel modesetting enabled. Sep 23 05:55:19 dfbsd kernel: [drm] amdgpu kernel modesetting enabled. [DF4740] module loaded: sysctl hw.df4740.test=1 (recovery UAF) or =2 (fini/TDR UAF) [DF4741] test2: scheduler with 1s TDR, hung job, drm_sched_fini(), then kfree(sched) as amdgpu does for struct amdgpu_ring after amdgpu_fence_driver_fini() [DF4741] job 0xfffff8008f929400 in flight, work_tdr armed (timeout=200 ticks); calling drm_sched_fini() [DF4741] drm_sched_fini() returned WITHOUT cancelling work_tdr or draining ring_mirror_list; freeing scheduler 0xfffff8008f844440 and reclaiming the block with zeroed memory (as any kzalloc consumer would) [DF4741] reclaim block 0 at 0xfffff8008f844440 (zeroed) [DF4741] reclaim block 1 at 0xfffff8008f8446c0 (zeroed) [DF4741] reclaim block 2 at 0xfffff8008f842dc0 (zeroed) [DF4741] reclaim block 3 at 0xfffff8008f8441c0 (zeroed) [DF4741] waiting for the armed work_tdr callout to fire on freed memory (~1-2s)... panic: _callout 0xfffff8008f968b80 verifier 0xfffff8008f844630 toc 0 (expected 0xfffff8008f968b80) func 0xffffffff86828b30/0xffffffff86828b30 cpuid = 3 Trace beginning at frame 0xfffff8008975a9c0 softclock_handler() at softclock_handler+0x502 0xffffffff80688782 softclock_handler() at softclock_handler+0x502 0xffffffff80688782 Debugger("panic") CPU3 stopping CPUs: 0x00000037 stopped Stopped at Debugger+0x7c: movb $0,0xbdaf09(%rip) db>