DF-5282 run log — all phases, untrimmed command outputs as captured.
Guest: DragonFly 6.5-DEVELOPMENT x86_64, QEMU 7.2 usb-ehci (8086:24cd),
ehci0 BAR 0xfebd1000-0xfebd1fff (0x1000), 6 ports, module ehci.ko.

================================================================================
PHASE 0 — discovery boot, EHCI attach
================================================================================
# dmesg | grep -iE "ehci|usbus|uhub|ugen"
ehci0: <Intel 82801DB/L/M (ICH4) USB 2.0 controller> mem 0xfebd1000-0xfebd1fff irq 10 at device 3.0 on pci0
usbus0: EHCI version 1.0
usbus0: on ehci0
usbus0: 480Mbps High Speed USB v2.0
ugen0.1: <Intel> at usbus0
uhub0: <Intel EHCI root HUB, class 9/0, rev 2.00/1.00, addr 1> on usbus0
uhub0: 6 ports with 6 removable, self powered
# pciconf -l | grep -i ehci
ehci0@pci0:0:3:0:  class=0x0c0320 card=0x11001af4 chip=0x24cd8086 rev=0x10 hdr=0x00
# usbconfig
ugen0.1: <Intel EHCI root HUB> at usbus0, cfg=0 md=HOST spd=HIGH (480Mbps) pwr=SAVE (0mA)

================================================================================
PHASE 1 — baseline roothub roundtrip (sane sc_offs=0x20)
================================================================================
-- GET_STATUS port1 (EOREAD4 PORTSC(1) @ +0x58):
REQUEST = <0x00 0x05 0x00 0x00>          # wPortStatus=0x0500 POWER|HIGH_SPEED
-- SET_FEATURE(UHF_PORT_SUSPEND=2) port1:  REQUEST = <OK>
-- GET_STATUS port1:                       REQUEST = <0x04 0x05 0x00 0x00>   # 0x0504 SUSPEND set
-- CLEAR_FEATURE(UHF_PORT_SUSPEND=2) p1:   REQUEST = <OK>
-- GET_STATUS port1:                       REQUEST = <0x00 0x05 0x00 0x00>   # 0x0500 SUSPEND cleared

================================================================================
PHASE 2 — poison latched (sc_offs 0x20 -> 0xFF, == malicious CAPLENGTH)
================================================================================
# kldload /root/ehcipwn/ehcipwn.ko ; dmesg | tail -4
ehcipwn: ehci0 softc=0xfffff8008dfc0000 io_hdl=0xfffff8008e147000 io_size=0x1000 offs=0x20 noport=6
ehcipwn: max poisoned reg offset = 0x17f (0xFF + 0x44 + 4*15); BAR covers [0,0xfff]
ehcipwn: NOTE io_size > 0x180 -> poisoned accesses stay IN-BAR on this guest (no page fault expected)
ehcipwn: ehci0 POISONED: sc_offs 0x20 -> 0xFF (simulated malicious CAPLENGTH)
-- GET_STATUS port1 (reads io_hdl+0x147):
REQUEST = <0x00 0x04 0x00 0x00>          # 0x0400: POWER bit GONE (wrong register read)
-- GET_STATUS port6 (reads io_hdl+0x15B):
REQUEST = <0x00 0x04 0x00 0x00>
-- SET_FEATURE(UHF_PORT_SUSPEND=2) port1 (EOWRITE4 @ io_hdl+0x147): REQUEST = <OK>
# kldunload ehcipwn ; dmesg | tail -1
ehcipwn: ehci0 restored sc_offs=0x20
-- GET_STATUS port1 with restored offset (real PORTSC(1) @ +0x68):
REQUEST = <0x00 0x05 0x00 0x00>          # NO SUSPEND bit -> poisoned write missed the real register
(control: the identical baseline request produced 0x0504)

================================================================================
PHASE 3 — live-lock (interrupt path), RUN A (fresh with-src snapshot)
================================================================================
# kldload poison; pre-hotplug alive: date -> Fri Oct 2 00:51:34 UTC 2026
# QEMU monitor: device_add usb-kbd,id=k1,bus=ehci0.0,port=1
t=6s:  Fri Oct  2 00:51:43 UTC 2026      # still answering
t=12s: Fri Oct  2 00:51:49 UTC 2026      # still answering
t=18s: (no output — ssh dead)
# vm.sh status => down
# ps -o %cpu -p <qemu> => 84.2  (guest spinning in interrupt storm)
# serial console: no further output, no panic text (boot.log ends at the poison line)
[1st occurrence (discovery, mouse pre-attached then poison then usb-kbd on port 2):
 same outcome — ssh dead, console silent, qemu 40.2% CPU, vm.sh status down]

================================================================================
PHASE 4 — control run (fresh with-src snapshot, NO poison)
================================================================================
# QEMU monitor: device_add usb-kbd,id=k1,bus=ehci0.0,port=1
# usbconfig
ugen0.1: <Intel EHCI root HUB> at usbus0, cfg=0 md=HOST spd=HIGH (480Mbps) pwr=SAVE (0mA)
ugen0.2: <QEMU QEMU USB Keyboard> at usbus0, cfg=0 md=HOST spd=HIGH (480Mbps) pwr=ON (100mA)
# dmesg | grep -iE "ukbd|kbd" | tail -3
ukbd0: <QEMU QEMU USB Keyboard, class 0/0, rev 2.00/0.00, addr 2> on usbus0
kbd2 at ukbd0
# date; uptime
Fri Oct  2 00:54:40 UTC 2026
12:54AM  up 34 secs, 0 users, load averages: 0.15, 0.04, 0.01
# vm.sh status => up        # guest healthy

================================================================================
PHASE 5 — fix validation
================================================================================
# patch applied to /usr/src: Hunk #1 succeeded at 327 (guard inserted)
# make quickkernel KERNCONF=X86_64_GENERIC -> completed; installkernel -> completed
# /boot/kernel/ehci.ko contains "invalid register geometry" (strings count=1); module loaded at boot (kldstat: ehci.ko)
# no-regression: ehci0 attaches, keyboard enumerates (ugen0.2), usbconfig OK
# trigger re-run on patched kernel (post-init corruption via KLD):
   kldload /root/ehcipwn/ehcipwn.ko; monitor: device_add usb-mouse,id=m2,bus=ehci0.0,port=3
   t=6s/12s/18s: no output; vm.sh status => down     # wedge persists (post-init vector; see VERDICT.md)
# final: vm.sh reset with-src  (guest returned to clean-source snapshot)