⬢ DragonFlyBSD Kernel Audit
DF-5652 / panic_raw.log
← back to finding ↓ download raw
	inet6 fe80::5054:ff:fe12:3456%vtnet0 prefixlen 64 tentative scopeid 0x1
	media: Ethernet 1000baseT <full-duplex>
	status: active
route: writing to routing socket: File exists
add net default: gateway 10.0.2.2: File exists
Additional routing options:.
Starting devd.
Additional TCP options:.
Mounting NFS file systems:.
ELF ldconfig path: /lib /usr/lib /usr/local/lib /usr/local/libdata/ldconfig/pkg
Building databases...
Starting syslogd.
Oct  9 09:41:06 dfbsd syslogd: kernel boot file is /boot/kernel/kernel

No core dumps found.
swap low/high-water marks set to 41940/62910
swapon: adding /dev/vbd0s1b as swap device
NFS CLIENT: access_cache_timeout=5 neg_cache_timeout=3.
Starting local daemons:.
Updating motd.
Configuring syscons: blanktime.
Starting sshd.
sendmail_submit: /etc/mail/aliases.db not present,  generating
sendmail_clientmqueue: /etc/mail/aliases.db not present,  generating
Starting cron.
Local package initialization:.

Fri Oct  9 09:41:06 UTC 2026


DragonFly/x86_64 (dfbsd) (ttyd0)



login: E0: ncpu=6 mycpuid=0 MachIntrABI.type=2 (ICU=1 IOAPIC=2) elcr_found=1
E0: hw ELCR=0x0c00 shadow LEVEL-bits=0x0c00 coherent=YES
E1: elcr_read_trigger(-1)=E (no panic: negative irq ACCEPTED, assert only checks irq<16)
E1: elcr_read_trigger(-22)=L vs elcr_read_trigger(10)=L -> ALIAS-PROVEN (1<<-22 materialized as 1<<10 on x86)
E1: hw still 0x0c00 (read path touches no ports)
E2: elcr_write_trigger(-27, LEVEL): hw0x4d0 0x00 -> 0x20 (bit5 SET), shadow trigger(5)=L
E2: restored: hw0x4d0=0x00 (was 0x00) trigger(5)=E (was E) ok=YES
R0: baseline trigger(5)=E trigger(7)=E hw=0x0c00 iters/thread=300000
R1: done=2 waited=2s lost_irq5=1827 lost_irq7=2158 (read-back mismatches = lost trigger-mode updates)
R1: final shadow trigger(5)=E (last written E) trigger(7)=E (last written E)
R2: restored: hw=0x0c00 (was 0x0c00) trigger(5)=E trigger(7)=E ok=YES
D1: raw outb flipped hw bit5: hw0x4d0=0x20 but elcr_read_trigger(5)=E -> kernel serves STALE shadow (no resync path exists; elcr_status read once at probe)
D2: after elcr_resume(): hw=0x0c00 baseline=0x0c00 repaired=YES (the dead function is exactly the missing fix)
E9: final hw=0x0c00 baseline=0x0c00 coherent=YES ticks=5736 -> guest HEALTHY
BOOM: calling elcr_write_trigger(16, LEVEL): expect 'panic: elcr_write_trigger: invalid IRQ 16' on this INVARIANTS kernel; on a production kernel the assert is compiled out (systm.h:117) and the call silently corrupts shadow bit 16 via 1<<16
panic: elcr_write_trigger: invalid IRQ 16
cpuid = 1
Trace beginning at frame 0xfffff801184477c8
elcr_write_trigger() at elcr_write_trigger+0x8c 0xffffffff80c0a3cc 
elcr_write_trigger() at elcr_write_trigger+0x8c 0xffffffff80c0a3cc 
elcrboom_modevent() at elcrboom_modevent+0x36 0xffffffff82600036 
module_register_init() at module_register_init+0x49 0xffffffff806232e9 
linker_load_file.part.3() at linker_load_file.part.3+0x1b9 0xffffffff80624619 
linker_load_module() at linker_load_module+0x116 0xffffffff80625e16 
Debugger("panic")

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>