== DF-5327 stage A+B run (vulnerable EVIL kernel, fresh periph state) ==
== stage B: premature free + regroom ==
[child1] open#1 done, fd OPEN, refcount=0 (*** 0: free-on-invalidate armed ***)
[parent] pre-invalidate refcount=0 (fd open)
[parent] invalidate done with the descriptor still open
[parent] postmortem(freed): periph 0xfffff8008d640ba0 size=144 refcnt_off=88: 00000000 00000000 ffffffff 00000000 802c6e40 ffffffff 802c6b20 ffffffff 802c6f30 ffffffff 80c3ca44 ffffffff 8d6c1060 fffff800 8fa6b800 fffff800 | fake_built=0 uaf_hits=0 fakeref@hit=00000000 premortem_refcnt=00000000
[parent] postmortem(regroomed): (no periph)
[child1] close on (freed) periph: refcount=-1
[parent] done
== rescan (recreate a fresh ch periph for stage A) ==
fresh ch periph refcount: 0
== stage A: 0-with-open-fd + close underflow ==
[child2] open#2: fd=-1 errno=4(Interrupted system call) refcount=1
[parent] open#2 reaped (interrupted) -- chopen error path ran unlock+cam_periph_release with CH_FLAG_OPEN set
[parent] refcount while open#1 still parked: 1 (expect 1: acquire+hold of open#1 minus the burned ref)
[child1] open#1 returned: refcount=0 (*** expect 0 -- undercounted with ch0 OPEN ***)
[child1] after close: refcount=-1 (*** expect -1: unmatched release ***)
[parent] done
== dmesg tail ==
(ch0:evilcd0:0:1:0): lost device
(ch0:evilcd0:0:1:0): removing device entry
ch0 at evilcd0 bus 0 target 1 lun 0
ch0: <EVILCH OOBTEST 1.0 > Removable Changer device
[EVILCD] deferring SCSI op 0x1a (cam_periph_cbwait park)
[EVILCD] deferred ccb released (fd holder parked forever is fine)
RUN_EXIT=0