DF-5562 run.log — BASELINE (unpatched kernel #0, with-src snapshot)
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64
QEMU: -device pci-ohci (Apple KeyLargo OHCI at pci0:0:3:0, mem 0xfebd1000-0xfebd10ff, irq 11)

Session transcript (ssh via vm.sh run_root; kernel prints land on the serial
console — panic.txt is the raw serial capture):

  # kldload /root/df5562/veto.ko
  DF5562: found ohci0 (driver ohci)
  DF5562: probe/attach deferred (driver-added event will attach)
  DF5562: harness loaded
  veto0: <DF-5562 detach-veto child> on ohci0
  veto0: attached to ohci0; my detach will EBUSY while the ohci driver is bound to the parent

  # sysctl hw.df5562=1        <-- THE TRIGGER (device_detach(ohci0), == kldunload/hot-unplug path)
  DF5562: ohci0 alive: HCCA VA=0xfffff8008df7b000 [0006a000 0006b000 0006c000 0006d000] ctrl-ED VA=0xfffff8008df7c000
  DF5562: calling device_detach(ohci0) [== what devclass_delete_driver does on kldunload / PCI hot-unplug]
  uhub0: detached
  ugen0.1: <Apple> at usbus0 (disconnected)
  unknown: at usbus0, port 1, addr 1 (disconnected)
  usbus0: detached                      <-- child #1 (usbus0) deleted cleanly
  veto0: DETACH VETO: returning EBUSY -- watch ohci_pci_detach swallow this and tear down anyway
                                       <-- child #2 VETOES: device_delete_children() == EBUSY
  ohci0: detached                       <-- ohci_pci_detach RETURNS 0 ANYWAY (the swallow);
                                           ohci_detach() reset the HC, IRQ torn down + released,
                                           MMIO released, usb_bus_mem_free_all() freed HCCA/ED
                                           DMA, "success" reported
  DF5562: device_detach(ohci0) returned 0 -- SUCCESS reported DESPITE live veto child (the lie)
  DF5562: post: ohci0 driver=(none) state=0            <-- DS_NOTPRESENT, driver unbound
  DF5562: ohci0 STILL has 1 child device(s): veto0(attached=1)   <-- ORPHANED ATTACHED CHILD

  # sysctl hw.df5562=2        <-- any subsequent touch of the parent context through the orphan
  (ssh session freezes mid-command -- kernel died underneath it)
  Fatal trap 12: page fault while in kernel mode
  fault virtual address = 0x58
  fault code = supervisor read data, page not present
  Stopped at df5562_thread+0x91: movq 0x58(%rax),%rcx
  db>                                <-- guest dead in DDB; vm.sh status => down

Root cause chain:
  sys/kern/subr_bus.c:1284-1292 device_delete_child() propagates the child's
  detach error (device_delete_children -> device_delete_child ->
  device_detach(child) == EBUSY); ohci_pci.c:329 DISCARDS the return;
  ohci_pci.c:331-357 then disables bus mastering, calls ohci_detach() (HC
  reset), tears down the interrupt, releases IRQ + MMIO BAR and frees all
  USB DMA memory (usb_bus_mem_free_all -> HCCA/ED pages); ohci_pci.c:359
  returns 0.  newbus then completes the "successful" detach:
  device_set_driver(dev, NULL) (subr_bus.c:2150 -> 1943-1945) kfrees
  dev->softc and NULLs it.  The vetoing child remains attached to a
  driverless parent whose softc is freed and whose IRQ/MMIO/DMA are gone --
  any interaction through it is a NULL-deref (observed: fault VA 0x58 ==
  NULL softc + offsetof(struct ohci_softc, sc_hw.hcca_pc.buffer)) or a
  use-after-free of the freed DMA pages (harness cmd3).