<6>swi2cs: layout proof (real struct resource_pool, real headers):
<6>swi2cs:   MAX_PIPES                = 6
<6>swi2cs:   GPIO_DDC_LINE_COUNT      = 8
<6>swi2cs:   &pool.sw_i2cs[5] (last legal) = 0xffffffff82600c20 (+608)
<6>swi2cs:   &pool.sw_i2cs[6] (OOB)       = 0xffffffff82600c28 (+616)
<6>swi2cs:   &pool.i2c_hw_buffer_in_use   = 0xffffffff82600c28
<6>swi2cs:   &pool.pipe_count             = 0xffffffff82600c2c
<6>swi2cs:   &pool.sw_i2cs[7] (OOB)       = 0xffffffff82600c30
<6>swi2cs:   &pool.underlay_pipe_index    = 0xffffffff82600c30
<6>swi2cs:   &pool.stream_enc_count       = 0xfffffff82600c34
<6>swi2cs: OOB AD

DragonFly/x86_64 (dfbsd) (ttyd0)



login:  ol.sw_i2cs[6] == 0x0000000600000000 (pipe_count=6 << 32 | hw_buf_in_use=0)
<6>swi2cs: OOB READ pool.sw_i2cs[7] == 0x00000003ffffffff (stream_enc_count=3 << 32 | underlay=-1)
<6>swi2cs:Sep 24 07:53:15 dfbsd kernel: swi2cs: layout proof (real struct resource_pool, real headers):
 both garbage values are NON-NULL -> the real code's 'if (!engine) return NULL' at dce_i2c_sw.c:538 does NOT save us
<6>swi2cs: FIRING - calling the REAL dce_i2c_acquire_i2c_sw_engine(&pool, &ddc)...
<6>swi2cs:   [stub] dal_ddc_open(en=6) -> GPIO_RESULT_OK (real gpio_service succeeds: busyness bitmap has 8 DDC pins, ddc_data_regs[GPIO_DDC_LINE_DDC_VGA] is valid)
Fatal user address access from kernel mode from kldload at ffffffff826008d9


Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address	= 0x600000000
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff826008d9
stack pointer	        = 0x10:0xfffff801183877e8
frame pointer	        = 0x10:0xfffff801183877f8
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 995
current thread          = pri 6 
kernel: type 12 trap, code=2

CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      dce_i2c_acquire_i2c_sw_engine+0x59:     movq    %rbx,(%r12)
db>