afmt_walk: 8192 objs of 280 bytes; usable chunk = 288 (want 288)
afmt_walk: adjacent pair A=0xfffff80117ccff00 B=0xfffff80117cd0020 (B-A=288 want 288)
afmt_walk: victim B[0..8) groomed to 0xffffffff82600380 (fake afmt)
afmt_walk: OOB READ dig->afmt (+288) == 0xffffffff82600380 (non-NULL -> guard at r600_hdmi.c:286 falls through)
afmt_walk: fake_afmt before: enabled=1 last_buffer_filled_status=0
afmt_walk: after call#1(status=1): last_buffer_filled_status=1  <- WILD WRITE via OOB-read pointer (r600_hdmi.c:291)
afmt_walk: after call#2(status=0): last_buffer_filled_status=0
afmt_walk: victim B[0..8) zeroed -> OOB read NULL -> replica returns 0 (silent; hides the bug)
afmt_walk: update_audio_settings replica (r600_hdmi.c:433->435): dig->afmt->enabled deref SURVIVED, dig->afmt->offset == 0x1234 -> would feed WREG32(HDMI0_* + offset) MMIO
afmt_walk: done


DragonFly/x86_64 (dfbsd) (ttyd0)



login: