DF5303: sc=0xfffff80118430000 sizeof=35400 &sc->ir[0x20]=0xfffff801184389c8 is 35272 bytes PAST the softc (ir[] ends at 0xfffff801184389c8) DF5303: calling production dump_db(sc, OHCI_MAX_DMA_CH=0x44) -- OOB dbch at ir[32], walk starts at crafted top=0x10 Fatal user address access from kernel mode from sysctl at ffffffff8068d270 Fatal trap 12: page fault while in kernel mode cpuid = 1; lapic id = 1 fault virtual address = 0x48 fault code = supervisor read data, page not present instruction pointer = 0x8:0xffffffff8068d270 stack pointer = 0x10:0xfffff80118179700 frame pointer = 0x10:0xfffff80118179768 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, long 0, def32 0, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 995 current thread = pri 6 kernel: type 12 trap, code=0 CPU1 stopping CPUs: 0x0000003d stopped Stopped at device_print_prettyname: movq 0x48(%rdi),%rax db>