# DF-5065 PATCHED run -- 2026-09-26, guest fresh from `vm.sh reset with-src`,
# /usr/src patched with fix.diff, dm.ko rebuilt (-Werror clean) and installed
# to /boot/kernel/dm.ko. IDENTICAL PoC (sh /tmp/run.sh) as the baseline panic.
#
# Result: NO PANIC. The dangerous `kldunload dm` (with dm_target_linear still
# loaded) is now correctly vetoed (EBUSY) by dm_target_uninit/dmdestroy;
# dm_target_linear then unloads cleanly through LIVE dm text; the dependency
# cascade unloads dm.ko properly afterwards. Guest stays up.
#
# Key lines (full trace below):
#   step 2  kldunload dm -> "can't unload file: Device busy"  (counter veto, refs 1->0)
#   step 4  kldstat: dm.ko Refs=1 (dep ref added on top of the underflowed base)
#   step 5  kldunload dm -> "can't unload file: Device busy"  <-- THE FIX VETOES
#           kldstat: dm.ko Refs=0 BUT STILL LOADED (no teardown, no freed text)
#   step 6  kldunload dm_target_linear -> rc=0, clean unload, no trap
#   final   kldstat: no dm modules; `kldunload dm` -> ENOENT (already unloaded
#           via the dependency cascade); "STILL_UP"
#
# (copied verbatim from `vm.sh run_root` output)

+ echo '=== step 0: state ==='
+ kldstat
=== step 0: state ===
Id Refs Address                Size Name
 1    5 0xffffffff80200000  1ad8538 kernel
 2    1 0xffffffff81cd9000    7c288 ehci.ko
 3    1 0xffffffff81d56000    8c778 xhci.ko
+ kldload dm
+ kldstat
+ grep dm
 4    1 0xffffffff82600000     6000 dm.ko
=== step 1: create device (dm_dev_counter=1) ===
+ /tmp/dmt_registry_uaf create df5065dev
create df5065dev: ok (0)
=== step 2: kldunload dm -> EBUSY veto -> kern_linker.c:518 refs-- (1->0) ===
+ kldunload dm
kldunload: can't unload file: Device busy
=== step 3: remove device (dm_dev_counter=0) ===
+ /tmp/dmt_registry_uaf remove df5065dev
remove df5065dev: ok (0)
=== step 4: kldload dm_target_linear (dm refs 0->1: pin defeated) ===
+ kldload dm_target_linear
+ kldstat
+ grep dm
 4    1 0xffffffff82600000     6000 dm.ko
 5    1 0xffffffff8260c000    12000 dm_target_linear.ko
=== step 5: kldunload dm -> SHOULD be vetoed by MODULE_DEPEND, is not:
    dm_target_uninit frees linear's registry entry + lockuninit, dm.ko freed ===
+ kldunload dm
kldunload: can't unload file: Device busy      <-- FIX: dm_target_uninit EBUSY (linear registered)
+ kldstat
+ grep dm
 4    0 0xffffffff82600000     6000 dm.ko       <-- Refs underflowed again by the
 5    1 0xffffffff8260c000    12000 dm_target_linear.ko   linker veto path, but dm.ko
                                                  STAYS LOADED (no teardown)
=== step 6: kldunload dm_target_linear -> dm_target_remove() through freed dm.ko text ===
+ kldunload dm_target_linear
unload_rc=0                                    <-- clean unload via LIVE dm text
=== SURVIVED (no panic) ===
+ kldstat
Id Refs Address                Size Name
 1    5 0xffffffff80200000  1ad8538 kernel
 2    1 0xffffffff81cd9000    7c288 ehci.ko
 3    1 0xffffffff81d56000    8c778 xhci.ko
FINAL_RC=0
=== extra: normal unload after linear gone ===
kldunload: can't find file dm: No such file or directory
dm_unload_rc=1
no dm modules loaded                           <-- dm already unloaded cleanly by
                                                  the dependency cascade (correct)
STILL_UP