DF-5011 run.log — BASELINE (bug): stock module-mode dimm.ko + dep-less user
===========================================================================
Guest: DragonFly 6.5-DEVELOPMENT #1 (custom X86_64_GENERIC w/o device dimm),
securelevel=-1, root shell over ssh. The panic at the end killed sshd; the
continuation is the serial-console capture (panic.txt has the same excerpt).

--- ssh transcript (verbatim) ---------------------------------------------
+ kldload dimm
kldload: can't load dimm: module already loaded or in kernel
    ^^ dimm.ko was already loaded from the pre-run smoke test
+ kldstat | grep -E dimm.ko
 4    1 0xffffffff82600000     d000 dimm.ko
+ kldload /root/df5011/deppoc.ko
    ^^ this binary turned out to be a STALE build WITHOUT MODULE_DEPEND
       (CFLAGS+=-DWANT_DEP never reached the compiler) — i.e. this run is
       the dep-less baseline; the true control was re-run later (run.2.log)
+ sysctl hw.dimminfo | head -3
hw.dimminfo.dimm0.node: 0
hw.dimminfo.dimm0.chan: 0
hw.dimminfo.dimm0.slot: 0
+ kldunload dimm
+ echo 'kldunload dimm rc=0'
CONTROL(deppoc loaded): kldunload dimm rc=0
    ^^^^^^^^^^^^^^^ BUG: unload SUCCEEDED while a KPI user holds the only
                     reference. dimm_mod_unload() drained the user's ref
                     (dimm.c:312-318) and kfree()d the live softc.
+ kldunload deppoc
<ssh session killed by host-side 60s timeout — guest was panicking>

--- serial console (dfbsd-qemu/boot.log, verbatim) ------------------------
login: drainpoc: dimm_create(0,0,0) -> sc=0xfffff800899b0800 ref=1 held by drainpoc
drainpoc: MOD_UNLOAD: dimm_destroy(0xfffff800899b0800) on object freed by dimm_mod_unload's drain (use-after-free / call into unmapped module text)

Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address	= 0xffffffff826004a0
fault code		= supervisor read instruction, page not present
instruction pointer	= 0x8:0xffffffff826004a0
stack pointer	        = 0x10:0xfffff80117ecb8b0
frame pointer	        = 0x10:0xfffff80117ecb8b8
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1538
current thread          = pri 6 
kernel: type 12 trap, code=10

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      -0x7d9ffb60:

(second trap while entering DDB, same VA — console ends at db> prompt;
 full text in panic.txt; kldstat had shown dimm.ko text base = 0xffffffff82600000,
 so fault VA 0xffffffff826004a0 = dimm.ko+0x4a0 = dimm_destroy() text, unmapped
 by the unload that drained the caller's reference)

--- interpretation ---------------------------------------------------------
1. dimm_softc created (ref=1) by a dep-less KPI user — same as ecc_e3.c does.
2. `kldunload dimm` returned 0: linker had no dep ref → real unload →
   dimm_mod_unload() looped dimm_destroy() until the list was empty:
   user's ref drained 1->0, sysctl tree torn down, softc kfree()d.
3. Victim's dimm_destroy() call = instruction fetch from unmapped module text
   => Fatal trap 12 => panic => system down (DoS). With heap grooming/timing
   this is equally a freed-object write (refcount dec) — memory corruption.