# DF-5015 decisive transcript excerpts (full session in agent transcript)
[Baseline, matched]
MARKER rows: [59] (matched => exactly one, row 59)
[Round 1 hunt, pure unpriv, old uptime]
attempt 12: MISMATCH! marker rows [3, 34, 59] (25-row ring wraps inside 60-row view)
[Round 2]
attempt 3: MISMATCH rows [28, 59]
Z rows in ttyv0 oldest view after fire: ['00','02','04',...,'32']  (append executed on armed ring)
[Round 3 + in-kernel probe]
== arm ==
scp=0xfffff8004f32e0a0 ... cols=80 rows=25 size=2000 buf=0xfffff80116d9b000 tail=800 xsize=80 ysize=25 prevphys=0xf263000 zprev=0 zin=0
attempt 3: MISMATCH rows [28, 59]
[Panic #1 - unpriv churn campaign: maxx dd/vmburst + uid-65534 flip loop; NO keyboard]
Fatal user address access from kernel mode from kt3 ... (scan tool - EXCLUDED, my tool)
--- later boot ---
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xffffffff7ffffffe
fault code = supervisor write data, page not present
Stopped at sc_vtb_bcopy+0x34: movw %dx,(%rsi,%rax,2)     <-- wild WRITE on vtb path (panic #1)
[Generic-issue control (excluded as confound)]
TIOCGWINSZ-only loop (never enters syscons driver): same-lwkt_reltokref-assertion panic, 4/4
[Fix build + validation]
patch -p1 < /tmp/fix.diff -> all hunks applied
KBUILD_DONE; kernel #2 Sat Sep 26 02:44 booted
/tmp/df5015 arm | tail -1 -> armed: 25-row history on ttyv1-7 (victims) and ttyv0
flip/CONS_SET/CONS_SCRSHOT/fill/shot all functional (uid 65534) -> FUNCTIONAL_OK
race soak (scroll x realloc): realloc: 353280 iters in 20s, PATCHED_ALIVE