options=43<RXCSUM,TXCSUM,RSS>
	inet 127.0.0.1 netmask 0xff000000
	inet6 ::1 prefixlen 128
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
	groups: lo
vtnet0: flags=808843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,PROXY> metric 0 mtu 1500
	options=28<VLAN_MTU,JUMBO_MTU>
	ether 52:54:00:12:34:56
	inet6 fe80::5054:ff:fe12:3456%vtnet0 prefixlen 64 tentative scopeid 0x1
	media: Ethernet 1000baseT <full-duplex>
	status: active
add net default: gateway 10.0.2.2
Additional routing options:.
Starting devd.
Additional TCP options:.
Mounting NFS file systems:.
ELF ldconfig path: /lib /usr/lib /usr/local/lib /usr/local/libdata/ldconfig/pkg
Building databases...
Starting syslogd.
Sep 23 05:54:53 dfbsd syslogd: kernel boot file is /boot/kernel/kernel

No core dumps found.
swap low/high-water marks set to 41940/62910
swapon: adding /dev/vbd0s1b as swap device
NFS CLIENT: access_cache_timeout=5 neg_cache_timeout=3.
Starting local daemons:.
Updating motd.
Configuring syscons: blanktime.
Starting sshd.
sendmail_submit: /etc/mail/aliases.db not present,  generating
sendmail_clientmqueue: /etc/mail/aliases.db not present,  generating
Starting cron.
Local package initialization:.

Wed Sep 23 05:54:53 UTC 2026


DragonFly/x86_64 (dfbsd) (ttyd0)



login: <6>[drm] amdgpu kernel modesetting enabled.
Sep 23 05:55:19 dfbsd kernel: [drm] amdgpu kernel modesetting enabled.
[DF4740] module loaded: sysctl hw.df4740.test=1 (recovery UAF) or =2 (fini/TDR UAF)
[DF4741] test2: scheduler with 1s TDR, hung job, drm_sched_fini(), then kfree(sched) as amdgpu does for struct amdgpu_ring after amdgpu_fence_driver_fini()
[DF4741] job 0xfffff8008f929400 in flight, work_tdr armed (timeout=200 ticks); calling drm_sched_fini()
[DF4741] drm_sched_fini() returned WITHOUT cancelling work_tdr or draining ring_mirror_list; freeing scheduler 0xfffff8008f844440 and reclaiming the block with zeroed memory (as any kzalloc consumer would)
[DF4741] reclaim block 0 at 0xfffff8008f844440 (zeroed)
[DF4741] reclaim block 1 at 0xfffff8008f8446c0 (zeroed)
[DF4741] reclaim block 2 at 0xfffff8008f842dc0 (zeroed)
[DF4741] reclaim block 3 at 0xfffff8008f8441c0 (zeroed)
[DF4741] waiting for the armed work_tdr callout to fire on freed memory (~1-2s)...
panic: _callout 0xfffff8008f968b80 verifier 0xfffff8008f844630 toc 0 (expected 0xfffff8008f968b80) func 0xffffffff86828b30/0xffffffff86828b30

cpuid = 3
Trace beginning at frame 0xfffff8008975a9c0
softclock_handler() at softclock_handler+0x502 0xffffffff80688782 
softclock_handler() at softclock_handler+0x502 0xffffffff80688782 
Debugger("panic")

CPU3 stopping CPUs: 0x00000037
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>