DF-5544 run.log — BASELINE (unpatched kernel #0, with-src snapshot)
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64
QEMU: piix3-usb-uhci at pci0:0:3:0 (uhci0, ports 0xc080-0xc09f, irq 10)

Session transcript (ssh via vm.sh run_root; kernel prints also land on the
serial console — see panic.txt for the raw serial capture):

  # kldload /root/df5544/veto.ko
  LOAD_OK
  DF5544: found uhci0 (driver uhci)
  DF5544: probe/attach deferred (driver-added event will attach)
  DF5544: harness loaded
  veto0: <DF-5544 detach-veto child> on uhci0
  veto0: attached to uhci0; my detach will EBUSY while the uhci driver is bound to the parent

  # sysctl hw.df5544=1        <-- THE TRIGGER (device_detach(uhci0), == kldunload/hot-unplug path)
  DF5544: uhci0 alive: frame-list VA=0xfffff8008df7b000 [0004c000 0004d000 0004e000 0004f000] QH-pool VA=0xfffff8008df7c000
  DF5544: calling device_detach(uhci0) [== what devclass_delete_driver does on kldunload / PCI hot-unplug]
  uhub0: detached
  ugen0.1: <Intel> at usbus0 (disconnected)
  unknown: at usbus0, port 1, addr 1 (disconnected)
  usbus0: detached                      <-- child #1 (usbus0) deleted cleanly
  veto0: DETACH VETO: returning EBUSY -- watch uhci_pci_detach swallow this and tear down anyway
                                       <-- child #2 VETOES: device_delete_children() == EBUSY
  uhci0: detached                       <-- uhci_pci_detach RETURNS 0 ANYWAY (the swallow);
                                           IRQ/IO released, usb_bus_mem_free_all() run, "success" reported
  DF5544: device_detach(uhci0) returned 0 -- SUCCESS reported DESPITE live veto child (the lie)
  DF5544: post: uhci0 driver=(none) state=0            <-- DS_NOTPRESENT, driver unbound
  DF5544: uhci0 STILL has 1 child device(s): veto0(attached=1)   <-- ORPHANED ATTACHED CHILD

  # sysctl hw.df5544=2        <-- any subsequent touch of the parent context through the orphan
  Fatal trap 12: page fault while in kernel mode
  fault virtual address = 0x5458
  fault code = supervisor read data, page not present
  instruction pointer = 0x8:0xffffffff826003c1
  Stopped at df5544_thread+0x2a1: movq 0x5458(%rax),%rcx
  db>                                <-- guest dead in DDB

Root cause chain:
  sys/kern/subr_bus.c:2131 device_detach() returns EBUSY from the child
  (device_delete_children -> device_delete_child -> device_detach(child));
  uhci_pci.c:374 discards the return; uhci_pci.c:380-409 then stops the
  controller, tears down the interrupt, releases IRQ + I/O and frees all
  bus DMA memory; uhci_pci.c:411 returns 0.  newbus then completes the
  "successful" detach: device_set_driver(dev, NULL) (subr_bus.c) kfrees
  dev->softc and NULLs it.  The vetoing child remains attached to a
  driverless parent whose softc is freed and whose IRQ/IO/DMA are gone --
  any interaction through it is a NULL-deref or use-after-free.