modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0  (freed drm_display_mode block fully chased)
modeuaf: verbatim dispatch ret=0 (canary fired above if 0)
modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled
modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0  (freed drm_display_mode block fully chased)
modeuaf: verbatim dispatch ret=0 (canary fired above if 0)
modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled
modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled
modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0  (freed drm_display_mode block fully chased)
modeuaf: verbatim dispatch ret=0 (canary fired above if 0)
modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled
modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0  (freed drm_display_mode block fully chased)
modeuaf: verbatim dispatch ret=0 (canary fired above if 0)
modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled
modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0  (freed drm_display_mode block fully chased)
modeuaf: verbatim dispatch ret=0 (canary fired above if 0)
modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled
modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled
modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0  (freed drm_display_mode block fully chased)
modeuaf: verbatim dispatch ret=0 (canary fired above if 0)
modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled
modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0  (freed drm_display_mode block fully chased)
modeuaf: verbatim dispatch ret=0 (canary fired above if 0)
modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled
modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0  (freed drm_display_mode block fully chased)
modeuaf: verbatim dispatch ret=0 (canary fired above if 0)
modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled
modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0  (freed drm_display_mode block fully chased)
modeuaf: verbatim dispatch ret=0 (canary fired above if 0)
modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled
modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0  (freed drm_display_mode block fully chased)
modeuaf: verbatim dispatch ret=0 (canary fired above if 0)
modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled
modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0  (freed drm_display_mode block fully chased)
modeuaf: verbatim dispatch ret=0 (canary fired above if 0)
modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled
modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled
modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0  (freed drm_display_mode block fully chased)
modeuaf: verbatim dispatch ret=0 (canary fired above if 0)
modeuaf: unloaded: calls=360451521 destroys=10873305 hits=32
modeuaf: sizeof(drm_display_mode)=240 base@+16 off(type)=20 off(props)=24 plane.funcs-off.base=96
modeuaf: target mode id=1 (0xfffff8008d3cdd00) — racing stock drm_mode_obj_set_property_ioctl vs drm_mode_destroy
modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled


Fatal trap 9: general protection fault while in kernel mode
cpuid = 5; lapic id = 5
instruction pointer	= 0x8:0xffffffff82634126
stack pointer	        = 0x10:0xfffff80117a7ba00
frame pointer	        = 0x10:0xfffff80117a7ba30
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= Idle
current thread          = pri 12 
kernel: type 9 trap, code=0

CPU5 stopping CPUs: 0x0000001f
 stopped
Stopped at      drm_mode_plane_set_obj_prop+0x36:       ret
db>