# DF-5454 baseline (VULNERABLE kernel, snapshot with-src, Jul 2 2026 build)
# command: kldload /root/df5454/df5454.ko   (as root over ssh)
# the ssh session never returned (timeout 25 -> rc 124); guest unresponsive afterwards (DDB)
$ ./run.sh
[serial console / dfbsd-qemu/boot.log lines 201-232:]
login: DF-5454: step0: pcie_cfgregopen(0x40000000, 0, 255) [what ACPI MCFG does at boot]
DF-5454: step1: CONTROL in-bounds read (255,31,7,0xffc,4) -- must NOT fault
DF-5454: control read ok: 0x00000000
DF-5454: step2: OOB READ (255,31,7,0xfff,2) -- last mapped byte + 1 byte past 256MB devmap

Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address	= 0xfffff80128660000
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff80c0b8d4
stack pointer	        = 0x10:0xfffff801183e77b8
frame pointer	        = 0x10:0xfffff801183e77c8
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1058
current thread          = pri 6
kernel: type 12 trap, code=0

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      pci_docfgregread+0xb4:  movzwl  (%rax),%eax
db>

# interpretation:
#  pcie_base == 0xfffff80118660000 (256MB mapping, kernel_map kmem_alloc_nofault)
#  fault VA 0xfffff80128660000 == pcie_base + 0x100000000>>?  (base + 256MB, first byte past the mapping)
#  'pci_docfgregread+0xb4: movzwl (%rax),%eax' is the inlined *(volatile uint16_t *) load of pciereg_cfgread
#  CONTROL read at reg=0xffc width=4 (last in-bounds dword) returned fine -> boundary is exactly reg+bytes