df5688[init]: count=255 nodes[525].allocated=-999 nodes[524].allocated=-999 nodes[511].allocated=-999
df5688[1]: idr_alloc(A, 526, 0, 0) -> 526
df5688[after-alloc-526]: count=1023 nodes[525].allocated=1 nodes[524].allocated=0 nodes[511].allocated=1
df5688[2]: idr_remove(525) [NEVER allocated] -> 0 (Linux semantics: NULL no-op; DF: PHANTOM DECREMENT)
df5688[after-phantom-remove-525]: count=1023 nodes[525].allocated=0 nodes[524].allocated=0 nodes[511].allocated=0
df5688[3]: idr_alloc(B, 525, 532, 0) -> 525
df5688[3]: idr_find(525) -> 0xdead0002
df5688[4]: idr_alloc(C, 525, 0, 0) -> 525
df5688[4]: idr_find(525) -> 0xdead0003 (object B was 0xdead0002)
df5688: *** DUPLICATE ID 525 CONFIRMED IN-KERNEL: two idr_alloc() calls returned the same id while live; the first object pointer (0xdead0002) was silently overwritten
df5688: *** object handle aliasing confirmed: handle 525 now maps to C (0xdead0003), B (0xdead0002) leaked
df5688: KERNEL MEMORY CORRUPTION (duplicate id) CONFIRMED
df5688p[1]: idr_alloc(A, 289, 290, 0) -> 289 (nodes[287]=1 nodes[255]=1)
df5688p[2]: idr_remove(287) [NEVER allocated] -> 0 (nodes[287]=1 nodes[255]=1)
df5688p[3]: idr_alloc(B, 290, 0, 0) -> 290 (nodes[287]=1 nodes[255]=1)
df5688p[4]: idr_remove(287) [NEVER allocated] -> 0 (nodes[287]=1 nodes[255]=1)
df5688p[5]: idr_remove(290) [live] -> about to decrement chain through nodes[287]=0 ...
panic: assertion "idp->idr_nodes[id].allocated >= 0" failed in idr_reserve at /usr/src/sys/libkern/linux_idr.c:197
cpuid = 3
Trace beginning at frame 0xfffff801188ff748
idr_reserve.isra.1() at idr_reserve.isra.1+0x71 0xffffffff809d54c1 
idr_reserve.isra.1() at idr_reserve.isra.1+0x71 0xffffffff809d54c1 
idr_remove() at idr_remove+0x60 0xffffffff809d58e0 
df5688p_handler() at df5688p_handler+0x127 0xffffffff82601127 
module_register_init() at module_register_init+0x49 0xffffffff806232e9 
linker_load_file.part.3() at linker_load_file.part.3+0x1b9 0xffffffff80624619 
Debugger("panic")

CPU3 stopping CPUs: 0x00000037
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>