DF-5452 panic.txt — baseline (unpatched kernel), captured from the QEMU serial
console (dfbsd-qemu boot.log) after `kldload /root/poc/nxirq/nxirq.ko`.
Guest: DragonFly 6.5-DEVELOPMENT #0 X86_64_GENERIC (options INVARIANTS), QEMU/KVM.

nxirq0: <nexus irq cpuid PoC> on motherboard
DF-5452: legacy helper (valid cpuid):   res=0xfffff800895d0868 rid=0
panic: nexus invalid cpuid: -1
cpuid = 0
Trace beginning at frame 0xfffff80117837648
nexus_alloc_resource() at nexus_alloc_resource+0x1d1 0xffffffff80c05cc1
nexus_alloc_resource() at nexus_alloc_resource+0x1d1 0xffffffff80c05cc1
bus_alloc_resource() at bus_alloc_resource+0x7c 0xffffffff8069071c
nxirq_attach() at nxirq_attach+0x86 0xffffffff82612086
device_doattach() at device_doattach+0x3af 0xffffffff8068dbef
bus_generic_driver_added() at bus_generic_driver_added+0x68 0xffffffff8068f9d8
Debugger("panic")

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

Interpretation:
- Leg 1 (bus_alloc_legacy_irq_resource, valid cpuid from
  machintr_legacy_intr_cpuid(5)): allocation SUCCEEDED — same vector, same
  rman family, only the cpuid differs.
- Leg 2 (plain bus_alloc_resource(dev, SYS_RES_IRQ, &rid, 5, 5, 1, ...) —
  subr_bus.c:3293-3300 defaults cpuid to -1): the unvalidated index reached
  nexus.c:377 KASSERT and panicked on this INVARIANTS kernel.
- On kernels built WITHOUT `options INVARIANTS` (KASSERT/KKASSERT compile to
  no-ops — sys/sys/systm.h:94-112), the same call computes rm = &irq_rman[-1]
  and passes that out-of-bounds static storage to rman_reserve_resource()
  as a struct rman: silent misinterpretation at best (zeroed BSS -> NULL
  return), wild TAILQ/token writes at worst (non-zero adjacent statics).