⬢ DragonFlyBSD Kernel Audit
DF-5847 / run-stock-attempts.log
← back to finding ↓ download raw
DF-5847 run log — stock kernel attempts (2026-10-26, console/ssh-captured)

Guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
(stock, INVARIANTS; same build as the two historical panic captures).

S-A  cycler vltime=0xffffffff, 300 s:
     cycler cycles=3264/s ... DONE addok=913277 adderr=0 delok=913277
     -> clean, no panic (913k cycles)

S-B  cycler vltime=0 (transcript-faithful), 420 s:
     cycler cycles=2681/s ... DONE addok=1215834 delok=1215834
     -> clean (1.22M cycles)

S-C  cycler vltime=0 + 3x(flooder+stretch) as maxx, 480 s:
     cycler cycles=2970/s ... DONE addok=1309581 delok=1309581
     flooders ~1.9k SYN/s each
     -> clean (1.31M cycles)

S-D  DIAGNOSTIC kernel (#1 Mon Oct 26 05:30:18 = stock + nd6 ring +
     tombstone tripwire: panics on ANY timer walk over an unlinked ln):
     cycler vltime=0 + 6 flooders + stretch, 600 s:
     cycler cycles=3371/s ... DONE addok=1675632 delok=1675632
     -> clean; NO tombstone hit (the timer never even observed an
        unlinked entry under this session's scheduling)

Total ~5.1M add/delete cycles without a re-trip, ~4x the historical
panic budget (stock-nd6-panic1.txt panicked after ~152 s / ~430k
cycles). Race window is real (structurally proven) but heavy-tailed.

HISTORICAL STOCK CAPTURES (this finding's panic evidence, same kernel
build, from the DF-3389 verification):
  stock-nd6-panic1.txt:
    panic: rt_llinfo(0xfffff8008d2c0390) is not equal to ln(0xfffff8008d2c0358)
    nd6_timer_dispatch() at nd6_timer_dispatch+0x60f
  stock-nd6-panic2.txt:
    panic: rt_llinfo(0x7fffffffffffffff) is not equal to ln(0xfffff8008ed62a10)
    nd6_timer_dispatch() at nd6_timer_dispatch+0x60f