# DF-5547 baseline, guest boot 2026-10-07T10:31 (vm.sh reset with-src, fresh disk)
# commands (root):
#   cd /root/df5547 && sh build.sh && kldload ./df5547.ko && sysctl kern.df5547_test=1
#   dmesg | tail -14
# verbatim console/dmesg output:
df5547: prepared fc=0xffffffff826066c40 fwdev=0xffffffff826066500 sizeof(fwmem_softc)=12 sizeof(fw_xfer)=152
df5547: fms=0xfffff8008d402520 iosize_max=65536
df5547: groom bank 0xfffff8008d481da0..0xfffff8008d482d00 adjacent pair idx=5
df5547: C=0xfffff8008d481dc0 N=0xfffff8008d481de0 -- b_data=C+3, b_bcount=29, guard=N starts at C+32
df5547: bcount=29 pay_len=32 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: 41 42 43 aa -> OOB WRITE
df5547: N[0..3] now: 41 42 43 aa (was AA AA AA AA)
df5547: bcount=1 pay_len=4 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: 41 42 43 aa -> OOB WRITE
df5547: bcount=2 pay_len=4 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: 41 42 aa aa -> OOB WRITE
df5547: bcount=3 pay_len=4 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: 41 aa aa aa -> OOB WRITE
df5547: bcount=5 pay_len=8 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: 41 42 43 aa -> OOB WRITE
df5547: bcount=2047 pay_len=2048 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: 41 aa aa aa -> OOB WRITE
df5547: bcount=28 pay_len=28 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: aa aa aa aa -> no change
df5547: bcount=32 pay_len=32 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: aa aa aa aa -> no change
df5547: DF-5547 REPRODUCED (1 byte past, in-buffer slack): 1 byte(s) past the 2047-byte buffer overwritten with responder bytes 41/42/43 (recv.pay_len=2048, buffer=2047)
# sysctl kern.df5547_status:
kern.df5547_status: 5547[DF-5547 REPRODUCED (1 byte past, in-buffer slack): 1 byte(s) past the 2047-byte buffer overwritten with responder bytes 41/42/43 (recv.pay_len=2048, buffer=2047)] 5548[not run]
#
# independent repeat, earlier boot 2026-10-07T10:19 (identical trigger):
df5547: C=0xfffff8004f102660 N=0xfffff8004f102680 -- b_data=C+3, b_bcount=29, guard=N starts at C+32
df5547: bcount=29 pay_len=32 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: 41 42 43 aa -> OOB WRITE
df5547: N[0..3] now: 41 42 43 aa (was AA AA AA AA)
(all odd lengths 1/2/3/5/2047 -> OOB WRITE; controls 28/32 -> no change)