# FIX VALIDATION — patched kernel (nativekernel build of X86_64_GENERIC with
# DF-5519+DF-5520 fix.diff applied to /usr/src/sys/bus/isa/x86_64/isa_dma.c;
# kernel #1 Tue Oct  6 20:57:57 UTC 2026). Baseline = stock kernel #0
# (run.log / panic.txt above).

## Boot A — DF-5519 clean module + DF-5520 silent module
df5519: [1] isa_dma_acquire(2)  = 0 (expect 0)
isa_dma_acquire: channel 34 out of range          <- FIX: was EBUSY-wrap alias
df5519: [1] isa_dma_acquire(34) = 22 (expect 16=EBUSY: 1<<34 wrapped onto bit 2)
isa_dma_release: channel 34 out of range          <- FIX: no-op, no state touched
isa_dma_acquire: channel 2 already in use
df5519: [2] after isa_dma_release(34): isa_dma_acquire(2) = 16   <- FIX: chan 2 STILL held
isa_dma_acquire: channel 9 out of range           <- FIX: invalid chan rejected
df5519: [3] isa_dma_acquire(9)  = 22 (expect 0: invalid chan accepted, no DIAGNOSTIC panic)
isa_dma_release: channel 9 out of range
df5520: isa_dma_acquire(1) = 0
df5520: isa_dma_init(1,64) = 0
df5520: isa_dmastart(READ, 64 bytes, chan 1) programmed
df5520: isa_dmadone(READ, nbytes=0x800, chan 1): unclamped bcopy out of the 64-byte bounce buffer
isa_dmadone: count 2048 exceeds bounce buffer size 64, clamping   <- FIX: clamp fired
df5520: leak+00030: e7 e7 ... (in-bounds residue only)
df5520: leak+00040: 00 00 ... (clamped — nothing beyond the bounce buffer copied)
(then the harness itself tripped the fix's intentional double-init panic by
 kldload-ing df5520f on the same channel in the same boot:
 "panic: isa_dma_init: impossible request" — harness artifact, the exact
 FreeBSD-style driver-bug panic the fix deliberately keeps; not the bug.)

## Boot B — fresh boot, fatal-size variant + forged-pointer module
df5520f (DONE_NBYTES=0x11000 — fatal on stock kernel, panic.txt):
isa_dmadone: count 69632 exceeds bounce buffer size 64, clamping
-> NO panic; guest alive; leak dump all zeros past the chunk.  FIXED.

df5519p (forged-pointer wild write — fatal on stock kernel):
isa_dma_init: channel 8 out of range
df5519p: isa_dma_init(8,0x1000) = 22              <- FIX: EINVAL, OOB writes never happen
-> NO forged dma_bouncebuf[0], dmastart(chan 0) used the real bounce buffer,
   NO page fault, guest alive.  FIXED.

## Summary
| behavior                        | stock kernel | patched kernel |
|---------------------------------|--------------|----------------|
| acquire(34) aliases chan 2      | EBUSY wrap   | EINVAL         |
| release(34) frees chan 2        | yes          | no             |
| acquire(9)/init(9) chan>=8      | accepted     | EINVAL         |
| init(8) OOB -> forged ptr write | panic        | rejected       |
| dmadone unclamped OOB read      | panic/leak   | clamped + warn |