### DF-5497 baseline run — Tue Oct  6 10:50:53 UTC 2026 — guest: DragonFly 6.5-DEVELOPMENT (X86_64_GENERIC)

## [1] userspace guard-page model (production fwcrom.c, userland compile): ./c5497_user
DF-5497 userspace model: production fwcrom.c vs guard-page ROM
subtest A: V=300, dir read at rom+1224 (guard page, +200 past ROM)
  walk start (depth=0), dir read expected at rom+1224
  SIGSEGV: fault address 0x80047e0ca, predicted OOB load 0x80047e0c8..0x80047e0cb (rom+1224, +202 past the 1024-byte ROM)
  -> child exit 42 (EXPECTED)
subtest B: V=0xffffff, dir read at rom+0x4000014 (+64 MB reach)
  walk start (depth=0), dir read expected at rom+67108884
  SIGSEGV: fault address 0x80447dc16, predicted OOB load 0x80447dc14..0x80447dc17 (rom+67108884, +67107862 past the 1024-byte ROM)
  -> child exit 42 (EXPECTED)
subtest C: V=100, dir read at rom+424 (in-ROM control)
  walk start (depth=0), dir read expected at rom+424
  walk finished cleanly, depth=-1 (no fault)
  -> child exit 0 (EXPECTED)
model exit: 0

## [2] KLD mode 1 — oracle: 5 descents +1224..+16408 past the kmalloc(1024) ROM, slab groomed
cc  -O2 -pipe -Dcrom_init_context=dfh_crom_init_context  -Dcrom_get=dfh_crom_get -Dcrom_next=dfh_crom_next  -Dcrom_search_key=dfh_crom_search_key  -Dcrom_has_specver=dfh_crom_has_specver  -Dcrom_parse_text=dfh_crom_parse_text -Dcrom_crc=dfh_crom_crc  -Dcrom_add_quad=dfh_crom_add_quad  -Dcrom_add_entry=dfh_crom_add_entry  -Dcrom_add_chunk=dfh_crom_add_chunk  -Dcrom_add_simple_text=dfh_crom_add_simple_text  -Dcrom_load=dfh_crom_load -I/sys -Wall  -D_KERNEL -Wall -Wredundant-decls -Wnested-externs -Wstrict-prototypes  -Wmissing-prototypes -Wpointer-arith -Wcast-qual  -Wold-style-definition -Wmissing-include-dirs  -Wno-pointer-sign -Winit-self -Wundef -Wno-unused-but-set-variable -std=gnu11 -Werror -DKLD_MODULE -nostdinc -I/sys -I. -Idragonfly -I/root/df5497/forwarder_x86_64/include -Idragonfly/../include -I/usr/include  -Wold-style-declaration -fno-common -ffreestanding -fno-stack-protector -fno-strict-aliasing -fno-strict-overflow -fno-asynchronous-unwind-tables -fno-omit-frame-pointer -mcmodel=kernel -mno-red-zone -mno-mmx -mno-sse -msoft-float -mno-fp-ret-in-387 -mindirect-branch=thunk-inline   -c df5497.c
kern.df5497_mode: 1 -> 1
kern.df5497_fire: 0 -> 1
--- dmesg ---
HAMMER2: INITIATE SPANs
swap low/high-water marks set to 41940/62910
DF5497 harness loaded (production fwcrom.c)
DF5497 mode1: 5 descents at +1224..+65560 bytes past the 1024-byte ROM (all inside the kmem heap: expect 0-5 'crom_next: bound check failed' oracle lines, no fault)
DF5497 mode1: walk finished after 5 crom_next() calls, depth=-1 -- UNEXPECTEDLY no fault (all probe offsets mapped)
DF5497 harness loaded (production fwcrom.c)
DF5497 mode1: 5 descents at +1224..+16408 bytes past the 1024-byte ROM, slab groomed with crc_len=1 pattern: expect 'crom_next: bound check failed' oracle lines, no fault
crom_next: bound check failed
crom_next: bound check failed
crom_next: bound check failed
crom_next: bound check failed
DF5497 mode1: walk finished after 64 crom_next() calls, depth=-1 -- UNEXPECTEDLY no fault (all probe offsets mapped)

## [3] KLD mode 2 — sweep +4MB..+64MB: sysctl fire never returns; guest panics (see panic.txt / serial console)
$ sysctl kern.df5497_mode=2; sysctl kern.df5497_fire=1
kern.df5497_mode: 1 -> 2
kern.df5497_fire: 1
<ssh session never returns; serial console below>

DF5497 mode2: 16 descents at +4 MB..+64 MB past the ROM in 4 MB steps: expect oracle lines then Fatal trap 12 in dfh_crom_next (unmapped kernel_map page)
crom_next: bound check failed
crom_next: bound check failed
crom_next: bound check failed
crom_next: bound check failed
panic: assertion "obj != NULL" failed in vm_object_hold_shared at /usr/src/sys/vm/vm_object.c:330
cpuid = 1
Trace beginning at frame 0xfffff8011842b038
vm_object_hold_shared() at vm_object_hold_shared+0x3f 0xffffffff809ab9bf 
vm_object_hold_shared() at vm_object_hold_shared+0x3f 0xffffffff809ab9bf 
vm_fault() at vm_fault+0x408 0xffffffff8099e0b8 
trap_pfault() at trap_pfault+0x9a 0xffffffff80bd52ca 
trap() at trap+0x17c 0xffffffff80bd5bcc 
calltrap() at calltrap+0x9 0xffffffff80b991fa 
--- trap 000000000000000c, rip = ffffffff82600113, rsp = fffff8011842b450, rbp = fffff8011842b478 ---
dfh_crom_next() at dfh_crom_next+0x53 0xffffffff82600113 
Debugger("panic")

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>