⬢ DragonFlyBSD Kernel Audit
DF-5752 / run.log
← back to finding ↓ download raw 
DragonFly/x86_64 (dfbsd) (ttyd0)



login: [harness] hci_unit_harness loaded: hciu_probe, hciuu_setup, hciu_fire, hciu_dump, hcius_fire, hciud_fire
[harness] === setup: attach unit + ACL link #5 ===
[harness] unit 0xfffff8004f2e81a0 link 0xfffff8004f20a890 attached
[harness] === DF-5752 baseline: 8 filler events back-to-back (passive dangling proof) ===
[harness] burst injected; waiting 3s for netisr...
[harness] done: dangling_observations=21 reuse_hits=0 mtap_calls=8
[harness] DF-5752 PROOF: at hci_mtap call #3: mbuf 0xfffff8011851e600 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff8011851e628 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #4: mbuf 0xfffff8011851e600 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff8011851e628 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #4: mbuf 0xfffff8011851e800 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff8011851e828 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #5: mbuf 0xfffff8011851e600 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff8011851e628 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #5: mbuf 0xfffff8011851e800 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff8011851e828 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #5: mbuf 0xfffff8011851ea00 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff8011851ea28 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #6: mbuf 0xfffff8011851e600 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff8011851e628 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #6: mbuf 0xfffff8011851e800 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff8011851e828 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #6: mbuf 0xfffff8011851ea00 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff8011851ea28 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #6: mbuf 0xfffff8011851ec00 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff8011851ec28 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #7: mbuf 0xfffff8011851e600 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff8011851e628 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #7: mbuf 0xfffff8011851e800 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff8011851e828 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #7: mbuf 0xfffff8011851ea00 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff8011851ea28 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #7: mbuf 0xfffff8011851ec00 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff8011851ec28 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #7: mbuf 0xfffff8011851ee00 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff8011851ee28 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #8: mbuf 0xfffff8011851e600 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff8011851e628 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] === DF-5752 baseline: 8 filler events back-to-back (passive dangling proof) ===
[harness] burst injected; waiting 3s for netisr...
[harness] done: dangling_observations=21 reuse_hits=0 mtap_calls=8
[harness] DF-5752 PROOF: at hci_mtap call #3: mbuf 0xfffff80117da7400 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff80117da7428 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #4: mbuf 0xfffff80117da7400 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff80117da7428 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #4: mbuf 0xfffff80117da7600 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff80117da7628 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #5: mbuf 0xfffff80117da7400 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff80117da7428 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #5: mbuf 0xfffff80117da7600 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff80117da7628 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #5: mbuf 0xfffff80117da7800 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff80117da7828 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #6: mbuf 0xfffff80117da7400 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff80117da7428 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #6: mbuf 0xfffff80117da7600 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff80117da7628 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #6: mbuf 0xfffff80117da7800 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff80117da7828 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #6: mbuf 0xfffff80117da7a00 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff80117da7a28 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #7: mbuf 0xfffff80117da7400 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff80117da7428 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #7: mbuf 0xfffff80117da7600 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff80117da7628 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #7: mbuf 0xfffff80117da7800 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff80117da7828 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #7: mbuf 0xfffff80117da7a00 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff80117da7a28 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #7: mbuf 0xfffff80117da7c00 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff80117da7c28 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] DF-5752 PROOF: at hci_mtap call #8: mbuf 0xfffff80117da7400 was already freed by hci_event() (hci_event.c m_freem) but its netmsg 0xfffff80117da7428 still had MSGF_QUEUED set -- the netisr port queue is holding and will _lwkt_pullmsg()/TAILQ_REMOVE/dispatch() through freed memory (flags=0x4)
[harness] === DF-5752 fire: 8 fillers + mid-drain re-injection at packet #3 ===
[harpnaenissc]  wbiutrh s1 stp iinjenlcoted;ck sw ahietlid
n
gp an3isc : fBoard ne tliisnrk. e.l.
m
 0xfffff80117da8428 next->prev != elm
cpuid = 0
Trace beginning at frame 0xfffff8008d1f8a50
lwkt_spin_getport() at lwkt_spin_getport+0x134 0xffffffff8067ae14 
lwkt_spin_getport() at lwkt_spin_getport+0x134 0xffffffff8067ae14 
netmsg_service_loop() at netmsg_service_loop+0xaf 0xffffffff8074646f 
Debugger("panic")

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>