gpio_intel0: iomem 0xd0000-0xd7fff irq 5 on acpi0 gfree2: gpio_intel0 dev=0xfffff8008bb7fbc0 sc=0xfffff8008dd4e080 mem_res=0xfffff800895d2fc8 KVA=0xffffffff800d0000 size=0x8000 gfree2: stale-cookie OOB target KVA+0x448800 (CTL0) / KVA+0x448804 (CTL1) [pin -1 -> uint16_t 65535] gfree2: planted pin8 CTL0=50008000 CTL1=00000002 gfree2: map5 before: pin=-1 intidx=0 gpio_intel0: pin=8 trigger=1 polarity=0 ctrl0=0x50008000 ctrl1=0x00000002 gfree2[CONTROL]: GPIO_ALLOC_INTR(pin8 line5) = 0 cookie=0xfffff8008dd4e190 gfree2[CONTROL]: documented order done; map5 now: pin=-1 intidx=-1 (freed cleanly) gfree2[DEFECT]: calling GPIO_FREE_INTR on the stale cookie again (map->pin == -1)... gpio_intel0: gpio_intel_free_intr: stale cookie (pin -1 not mapped) gfree2[DEFECT]: SURVIVED -- OOB access at KVA+0x448800 / KVA+0x448804 was silent; kernel memory past the 32KB mapdev mapping was read (and bits 0..2 / 8..10 conditionally cleared) by the stale-cookie unmap gfree2: guest still running; check dmesg for corruption side-effects gpio_intel0: Failed to alloc GpioIo pin 8 on ResourceSource "\_SB.GPO0"