login: <6>swi2cs: layout proof (real struct resource_pool, real headers):
<6>swi2cs:   MAX_PIPES                = 6
<6>swi2cs:   GPIO_DDC_LINE_COUNT      = 8
<6>swi2cs:   &pool.sw_i2cs[5] (last legal) = 0xffffffff82600c40 (+608)
<6>swi2cs:   &pool.sw_i2cs[6] (OOB)       = 0xffffffff82600c48 (+616)
<6>swi2cs:   &pool.i2c_hw_buffer_in_use   = 0xffffffff82600c48
<6>swi2cs:   &pool.pipe_count             = 0xffffffff82600c4c
<6>swi2cs:   &pool.sw_i2cs[7] (OOB)       = 0xffffffff82600c50
<6>swi2cs:   &pool.underlay_pipe_index    = 0xffffffff82600c50
<6>swi2cs:   &pool.stream_enc_count       = 0xffffffff82600c54
<6>swi2cs: OOB READ pool.sw_i2cs[6] == 0x0000000600000000 (pipe_count=6 << 32 | hw_buf_in_use=0)
<6>swi2cs: OOB READ pool.sw_i2cs[7] == 0x00000003ffffffff (stream_enc_count=3 << 32 | underlay=-1)
<6>swi2cs: both garbage values are NON-NULL -> the real code's 'if (!engine) return NULL' at dce_i2c_sw.c:538 does NOT save us
<6>swi2cs: FIRING - calling the REAL dce_i2c_acquire_i2c_sw_engine(&pool, &ddc)...
<6>swi2cs: acquire returned 0 (NULL = correctly rejected)
<6>swi2cs: unloaded
Sep 24 07:59:55 dfbsd kernel: swi2cs: layout proof (real struct resource_pool, real headers):
Sep 24 07:59:55 dfbsd kernel: swi2cs:   MAX_PIPES                = 6
Sep 24 07:59:55 dfbsd kernel: swi2cs:   GPIO_DDC_LINE_COUNT      = 8
Sep 24 07:59:55 dfbsd kernel: swi2cs:   &pool.sw_i2cs[5] (last legal) = 0xffffffff82600c40 (+608)
Sep 24 07:59:55 dfbsd kernel: swi2cs:   &pool.sw_i2cs[6] (OOB)       = 0xffffffff82600c48 (+616)
Sep 24 07:59:55 dfbsd kernel: swi2cs:   &pool.i2c_hw_buffer_in_use   = 0xffffffff82600c48
Sep 24 07:59:55 dfbsd kernel: swi2cs:   &pool.pipe_count             = 0xffffffff82600c4c
Sep 24 07:59:55 dfbsd kernel: swi2cs:   &pool.sw_i2cs[7] (OOB)       = 0xffffffff82600c50
Sep 24 07:59:55 dfbsd kernel: swi2cs:   &pool.underlay_pipe_index    = 0xffffffff82600c50
Sep 24 07:59:55 dfbsd kernel: swi2cs:   &pool.stream_enc_count       = 0xffffffff82600c54
Sep 24 07:59:55 dfbsd kernel: swi2cs: OOB READ pool.sw_i2cs[6] == 0x0000000600000000 (pipe_count=6 << 32 | hw_buf_in_use=0)
Sep 24 07:59:55 dfbsd kernel: swi2cs: OOB READ pool.sw_i2cs[7] == 0x00000003ffffffff (stream_enc_count=3 << 32 | underlay=-1)
Sep 24 07:59:55 dfbsd kernel: swi2cs: both garbage values are NON-NULL -> the real code's 'if (!engine) return NULL' at dce_i2c_sw.c:538 does NOT save us
Sep 24 07:59:55 dfbsd kernel: swi2cs: FIRING - calling the REAL dce_i2c_acquire_i2c_sw_engine(&pool, &ddc)...
Sep 24 07:59:55 dfbsd kernel: swi2cs: acquire returned 0 (NULL = correctly rejected)
Sep 24 07:59:55 dfbsd kernel: swi2cs: unloaded