DF-5399 / run.log
DF-5399 run.log — decisive runs (KLD harness, production usbd_transfer_unsetup+uether_ifdetach) ========================================================================================= BASELINE (pristine with-src guest, stock uether.ko auto-loaded via MODULE_DEPEND) -------------------------------------------------------------------------------- # kldload -v /root/df5399/mos_poc.ko (serial console — ssh session died with the guest; captured from vm.sh log) mos_poc: constructing post-'allocating USB transfers failed' state (if_mos.c:694-707) mos_poc: state check: ue_lock=0 ue_dev=0 ue_udev=0 ue_tq.up_lock=0 (all must be 0/NULL) mos_poc: entering mos_detach() replay: usbd_transfer_unsetup() + uether_ifdetach() (if_mos.c:762-763) Fatal user address access from kernel mode from kldload at ffffffff80647bad Fatal trap 12: page fault while in kernel mode cpuid = 1; lapic id = 1 fault virtual address = 0x0 fault code = supervisor read data, page not present instruction pointer = 0x8:0xffffffff80647bad stack pointer = 0x10:0xfffff8011838b748 frame pointer = 0x10:0xfffff8011838b7a8 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, long 0, def32 0, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 1008 current thread = pri 10 kernel: type 12 trap, code=0 CPU1 stopping CPUs: 0x0000003d stopped Stopped at lockmgr_exclusive+0x5d: orl (%r14),%esi db> (full record in panic.txt; guest dead in DDB — 1/1 run, deterministic NULL deref) PATCHED (fix.diff applied to guest /usr/src; uether.ko + if_mos.ko rebuilt -Werror clean; patched uether.ko installed into /boot/kernel; identical harness rebuilt) -------------------------------------------------------------------------------- # kldload -v /root/df5399/mos_poc.ko Loaded /root/df5399/mos_poc.ko, id=4, path=/root/df5399/mos_poc.ko mos_poc: constructing post-'allocating USB transfers failed' state (if_mos.c:694-707) mos_poc: state check: ue_lock=0 ue_dev=0 ue_udev=0 ue_tq.up_lock=0 (all must be 0/NULL) mos_poc: entering mos_detach() replay: usbd_transfer_unsetup() + uether_ifdetach() (if_mos.c:762-763) mos_poc: SURVIVED uether_ifdetach() (UNEXPECTED - guard present?) KLDLOAD_RC=0 # dmesg | grep -c "Fatal trap" 0 # kldstat | grep mos_poc 4 1 0xffffffff82600000 1000 mos_poc.ko # kldunload mos_poc && echo UNLOAD_OK_1 UNLOAD_OK_1 GONE_1 # kldload /root/df5399/mos_poc.ko && kldunload mos_poc && echo UNLOAD_OK_2 UNLOAD_OK_2 # dmesg | grep -c "Fatal trap" 0 --- patched driver module sanity --- # kldload -v /usr/src/sys/bus/u4b/net/mos/if_mos.ko && echo DRIVER_LOAD_OK && kldunload if_mos && echo DRIVER_UNLOAD_OK Loaded /usr/src/sys/bus/u4b/net/mos/if_mos.ko, id=8, path=/usr/src/sys/bus/u4b/net/mos/if_mos.ko DRIVER_LOAD_OK DRIVER_UNLOAD_OK # dmesg | grep -c "Fatal trap" 0