DF-5547 / fix_validation.log
# DF-5547 fix validation (same guest, same harness, ONLY change = fix.diff applied # to /usr/src/sys/bus/firewire/fwmem.c, module rebuilt from the patched production file) # commands (root): # cp fwmem.fixed.c /usr/src/sys/bus/firewire/fwmem.c && cd /root/df5547 && sh build.sh # kldload ./df5547.ko && sysctl kern.df5547_test=1 && dmesg | grep "bytes past buffer" # verbatim output: === TEST 1 (fixed: expect NO OOB) === kern.df5547_test: 0 -> 0 df5547: bcount=29 pay_len=32 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: aa aa aa aa -> no change df5547: bcount=1 pay_len=4 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: aa aa aa aa -> no change df5547: bcount=2 pay_len=4 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: aa aa aa aa -> no change df5547: bcount=3 pay_len=4 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: aa aa aa aa -> no change df5547: bcount=5 pay_len=8 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: aa aa aa aa -> no change df5547: bcount=2047 pay_len=2048 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: aa aa aa aa -> no change df5547: bcount=28 pay_len=28 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: aa aa aa aa -> no change df5547: bcount=32 pay_len=32 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: aa aa aa aa -> no change # => the identical padded-response trigger no longer writes past any buffer; the RPC # still completes (biodone=1, b_error=0, resid=0). fix_status: fixed.