Wed Sep 30 23:55:09 UTC 2026


DragonFly/x86_64 (dfbsd) (ttyd0)



login: <6>[drm] amdgpu kernel modesetting enabled.
Oct  1 01:06:59 dfbsd kernel: [drm] amdgpu kernel modesetting enabled.
[DF5200] loaded (kthread shim from drm.ko)
[DF5200] t1 r1/5: park() returned; worker visits during 500ms 'parked' window: 13 -> 38 (RAN WHILE PARKED) SHOULD_PARK bit now=0
[DF5200] t1 r2/5: park() returned; worker visits during 500ms 'parked' window: 44 -> 69 (RAN WHILE PARKED) SHOULD_PARK bit now=0
[DF5200] t1 r3/5: park() returned; worker visits during 500ms 'parked' window: 75 -> 100 (RAN WHILE PARKED) SHOULD_PARK bit now=0
[DF5200] t1 r4/5: park() returned; worker visits during 500ms 'parked' window: 106 -> 131 (RAN WHILE PARKED) SHOULD_PARK bit now=0
[DF5200] t1 r5/5: park() returned; worker visits during 500ms 'parked' window: 137 -> 162 (RAN WHILE PARKED) SHOULD_PARK bit now=0
[DF5200] t1 RESULT: 5/5 rounds violated the park quiescence contract; 125 post-park visits total
[DF5200] t1 r1/5: park() returned; worker visits during 500ms 'parked' window: 13 -> 38 (RAN WHILE PARKED) SHOULD_PARK bit now=0
[DF5200] t1 r2/5: park() returned; worker visits during 500ms 'parked' window: 44 -> 69 (RAN WHILE PARKED) SHOULD_PARK bit now=0
[DF5200] t1 r3/5: park() returned; worker visits during 500ms 'parked' window: 75 -> 100 (RAN WHILE PARKED) SHOULD_PARK bit now=0
[DF5200] t1 r4/5: park() returned; worker visits during 500ms 'parked' window: 106 -> 131 (RAN WHILE PARKED) SHOULD_PARK bit now=0
[DF5200] t1 r5/5: park() returned; worker visits during 500ms 'parked' window: 137 -> 162 (RAN WHILE PARKED) SHOULD_PARK bit now=0
[DF5200] t1 RESULT: 5/5 rounds violated the park quiescence contract; 125 post-park visits total
[DF5200] t2 r1/5: UAF WRITE PROVEN: live victim 0xfffff80116f3ce00 (freed entity 0xfffff80116f3ce00, overlap=yes) corrupted by the 'parked' worker: visits=10 payload[0]=0 payload[30]=0
[DF5200] t2 r2/5: UAF WRITE PROVEN: live victim 0xfffff80116f3ce00 (freed entity 0xfffff80116f3ce00, overlap=yes) corrupted by the 'parked' worker: visits=10 payload[0]=0 payload[30]=0x4141414141414141
[DF5200] t2 r3/5: UAF WRITE PROVEN: live victim 0xfffff80116f3ce00 (freed entity 0xfffff80116f3ce00, overlap=yes) corrupted by the 'parked' worker: visits=10 payload[0]=0 payload[30]=0
[DF5200] t2 r4/5: UAF WRITE PROVEN: live victim 0xfffff80116f3ce00 (freed entity 0xfffff80116f3ce00, overlap=yes) corrupted by the 'parked' worker: visits=10 payload[0]=0 payload[30]=0
[DF5200] t2 r5/5: UAF WRITE PROVEN: live victim 0xfffff80116f3ce00 (freed entity 0xfffff80116f3ce00, overlap=yes) corrupted by the 'parked' worker: visits=10 payload[0]=0 payload[30]=0
[DF5200] t2 RESULT: 5/5 rounds corrupted the reallocated victim (5 same-address overlaps); 82 UAF reads of freed memory (badmagic 0 -> 82); total worker writes=95
[DF5201] loaded (linux_task_alloc from drm.ko)
[DF5201] r1 W1: td=0xfffff8008df44e80 stale_on_entry=0; current -> linux_task_alloc installed task=0xfffff8008f948b80 (dfly_td=0xfffff8008df44e80, pid=-1)
[DF5201] r1 W2: td=0xfffff8008ed9e180 clean (no stale task)
[DF5201] r2 W1: td=0xfffff800905fba80 stale_on_entry=0; current -> linux_task_alloc installed task=0xfffff800897a5080 (dfly_td=0xfffff800905fba80, pid=-1)
[DF5201] r2 W2: td=0xfffff800905fba80 clean (no stale task)
[DF5201] r3 W1: td=0xfffff800905fc100 stale_on_entry=0; current -> linux_task_alloc installed task=0xfffff8008f90d780 (dfly_td=0xfffff800905fc100, pid=-1)
[DF5201] r3 W2: td=0xfffff800905fc780 clean (no stale task)
[DF5201] r4 W1: td=0xfffff800905fce00 stale_on_entry=0; current -> linux_task_alloc installed task=0xfffff8008f948c80 (dfly_td=0xfffff800905fce00, pid=-1)
[DF5201] r4 W2: td=0xfffff800905fd480 clean (no stale task)
[DF5201] r5 W1: td=0xfffff800905fdb00 stale_on_entry=0; current -> linux_task_alloc installed task=0xfffff800897a5180 (dfly_td=0xfffff800905fdb00, pid=-1)
[DF5201] r5 W2: td=0xfffff800905fdb00 clean (no stale task)
[DF5201] r6 W1: td=0xfffff800905fe180 stale_on_entry=0; current -> linux_task_alloc installed task=0xfffff8008f90d600 (dfly_td=0xfffff800905fe180, pid=-1)
[DF5201] r6 W2: td=0xfffff800905fe800 clean (no stale task)
[DF5201] r7 W1: td=0xfffff800905fee80 stale_on_entry=0; current -> linux_task_alloc installed task=0xfffff8008f948d00 (dfly_td=0xfffff800905fee80, pid=-1)
[DF5201] r7 W2: td=0xfffff800905ff500 clean (no stale task)
[DF5201] r8 W1: td=0xfffff800905e0080 stale_on_entry=0; current -> linux_task_alloc installed task=0xfffff800897a5200 (dfly_td=0xfffff800905e0080, pid=-1)
[DF5201] r8 W2: td=0xfffff800905e0080 clean (no stale task)
[DF5201] RESULT: 0/8 rounds handed a recycled td carrying a stale (leaked, never-dropped) task_struct as td_linux_task
[DF5200] loaded (kthread shim from drm.ko)
[DF5200] t2 r1/5: UAF WRITE PROVEN: live victim 0xfffff801186c4e00 (freed entity 0xfffff801186c4e00, overlap=yes) corrupted by the 'parked' worker: visits=10 payload[0]=0 payload[30]=0
panic: DF5200: kthread_park() quiescence broken - 'parked' worker UAF-wrote freed-then-reallocated memory (victim->visits=11 payload[0]=0)
cpuid = 0
Trace beginning at frame 0xfffff80117b33718
df5200_test2() at df5200_test2+0x35d 0xffffffff873bd71d 
df5200_test2() at df5200_test2+0x35d 0xffffffff873bd71d 
sysctl_df5200_test() at sysctl_df5200_test+0x5a 0xffffffff873bd77a 
sysctl_root.isra.5() at sysctl_root.isra.5+0x166 0xffffffff80683d06 
userland_sysctl() at userland_sysctl+0x111 0xffffffff806840a1 
sys___sysctl() at sys___sysctl+0x74 0xffffffff80684204 
Debugger("panic")

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>