## Host environment - Operating system: Linux (Ubuntu) - OS/kernel version: Linux 6.8.0-101-generic - Architecture: x86_64 - QEMU flavor: qemu-system-i386 - QEMU version: QEMU emulator version 11.0.0 (v11.0.0), built with `--enable-debug --enable-asan --enable-ubsan` - QEMU command line: ``` qemu-system-i386 -display none -machine accel=qtest, -m 512M,slots=4,maxmem=2G \ -device megasas -machine pc -nodefaults \ -device scsi-cd,drive=null0 -blockdev driver=null-co,read-zeroes=on,node-name=null0 \ -qtest stdio ``` ## Emulated/Virtualized environment - Operating system: N/A (qtest) - OS/kernel version: N/A - Architecture: N/A ## Description of problem A guest-triggerable NULL pointer dereference (SEGV) occurs in `address_space_unregister_map_client()`, reached from `dma_aio_cancel()`, when an `MFI_IDB` abort cancels a megasas SCSI request whose scatter-gather list has already been destroyed. ``` system/physmem.c:3618:5: runtime error: member access within null pointer of type 'AddressSpace' ==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000009c #0 qemu_mutex_lock_impl util/qemu-thread-posix.c:107:5 #1 qemu_lockable_mutex_lock include/qemu/lockable.h:56:1 #2 qemu_lockable_lock include/qemu/lockable.h:110:5 #3 qemu_lockable_auto_lock include/qemu/lockable.h:120:5 #4 address_space_unregister_map_client system/physmem.c:3618:5 #5 dma_aio_cancel system/dma-helpers.c:200:9 #6 bdrv_aio_cancel_async block/io.c:3014:9 #7 bdrv_aio_cancel block/io.c:3002:5 #8 blk_aio_cancel block/block-backend.c:1729:5 #9 scsi_req_cancel hw/scsi/scsi-bus.c:1708:9 #10 megasas_abort_command hw/scsi/megasas.c:631:9 #11 megasas_mmio_write hw/scsi/megasas.c:2086:17 #12 megasas_port_write hw/scsi/megasas.c:2204:5 SUMMARY: AddressSanitizer: SEGV util/qemu-thread-posix.c:107:5 in qemu_mutex_lock_impl ``` ### Analysis Line numbers below are from `v11.0.0`, on which the backtrace above was produced. Re-running the reproducer with `--trace 'megasas_*' --trace 'dma_*'` shows the following sequence. 1. An `LD SCSI READ` frame is queued in frame slot 0. `megasas_map_sgl()` builds the command's SG list in place with `pci_dma_sglist_init(&cmd->qsg, ...)`; `megasas_get_sg_list()` returns `&cmd->qsg` to the SCSI layer (`scsi-bus.c: req->sg = req->bus->info->get_sg_list(req)`), and `scsi-disk.c` passes it to `dma_blk_io()`, which stores the _pointer_ in `dbs->sg`. ``` megasas_qf_enqueue frame 0x0 count 11 context 0xfee184ac head 0x203 tail 0x22d0202 busy 1 megasas_handle_scsi LD SCSI dev 1/0/0 sdev 0x518000001c80 xfer 2188422204 megasas_scsi_read_start scmd 0: transfer -2106545092 bytes of data dma_blk_io dbs=0x50e00000e900 bs=0x51600002df80 offset=0 to_dev=0 ``` 2. `dma_blk_cb()` cannot map the guest addresses, so it registers a map client and parks the transfer with `dbs->bh` set. The request stays in flight and `cmd->req` stays set. ``` dma_blk_cb dbs=0x50e00000e900 ret=0 dma_map_wait dbs=0x50e00000e900 ``` 3. A later `MFI_CMD_INIT` frame reaches `megasas_init_firmware()`, which ends with `megasas_reset_frames()`: ``` megasas_init_firmware pa 0x0 megasas_init_queue queue at 0x82853f27fee184ac len 0 head 0x0 tail 0x0 flags 0x204 ``` ```c static void megasas_reset_frames(MegasasState *s) { for (i = 0; i < s->fw_cmds; i++) { cmd = &s->frames[i]; if (cmd->pa) { megasas_unmap_frame(s, cmd); } } bitmap_zero(s->frame_map, MEGASAS_MAX_FRAMES); } ``` `megasas_unmap_frame()` calls `qemu_sglist_destroy(&cmd->qsg)`, and `qemu_sglist_destroy()` (`system/dma-helpers.c`) ends with `memset(qsg, 0, sizeof(*qsg))`, so `frames[0].qsg.as` becomes NULL while `dbs->sg` still points at that struct. Neither function cancels, drains, or even inspects `cmd->req`. (`megasas_soft_reset()` calls `megasas_abort_command()` for every frame _before_ `megasas_reset_frames()`; the `megasas_init_firmware()` path has no such step.) 4. A write to `MFI_IDB` with `MFI_FWINIT_ABORT` then runs `megasas_abort_command()` over all frames. `cmd->req` is still set — nothing in step 3 cleared it — so `scsi_req_cancel()` reaches `dma_aio_cancel()`, which takes the `dbs->bh` branch and passes the SG list's address space straight through: ```c if (dbs->bh) { address_space_unregister_map_client(dbs->sg->as, dbs->bh); ... ``` ``` megasas_mmio_writel reg MFI_IDB: 0x66c7 dma_aio_cancel dbs=0x50e00000e900 ``` The cancelled `dbs` is the transfer parked in step 2. 5. `address_space_unregister_map_client()` dereferences the pointer immediately: ```c void address_space_unregister_map_client(AddressSpace *as, QEMUBH *bh) { AddressSpaceMapClient *client; QEMU_LOCK_GUARD(&as->map_client_list_lock); ``` With `as == NULL` this faults. A possible fix would be to cancel/drain a command's in-flight request before `megasas_unmap_frame()` destroys its SG list. ## Steps to reproduce 1. Build QEMU with sanitizers: ```sh ./configure --enable-sanitizers && make -j$(nproc) ``` 2. Replay the qtest sequence below (also provided as the attached [repro.sh](/uploads/962c47980fab84263867f67c4a65b8de/repro.sh), which can be run directly with `QEMU=./build/qemu-system-i386 ./repro.sh`). ```sh cat <<'EOF' | ./build/qemu-system-i386 \ -display none -machine accel=qtest, -m 512M,slots=4,maxmem=2G \ -device megasas -machine pc -nodefaults \ -device scsi-cd,drive=null0 -blockdev driver=null-co,read-zeroes=on,node-name=null0 \ -qtest stdio outl 0xcf8 0x80001000 inw 0xcfc outl 0xcf8 0x80001010 outl 0xcfc 0xffffffff outl 0xcf8 0x80001010 inl 0xcfc outl 0xcf8 0x80001010 outl 0xcfc 0xe0000000 outl 0xcf8 0x80001018 outl 0xcfc 0xffffffff outl 0xcf8 0x80001018 inl 0xcfc outl 0xcf8 0x80001018 outl 0xcfc 0xc001 outl 0xcf8 0x8000101c outl 0xcfc 0xffffffff outl 0xcf8 0x8000101c inl 0xcfc outl 0xcf8 0x8000101c outl 0xcfc 0xe0040000 outl 0xcf8 0x80001004 inw 0xcfc outl 0xcf8 0x80001004 outw 0xcfc 0x7 outl 0xcf8 0x80001004 inw 0xcfc outl 0xcf8 0x80001034 inb 0xcfc outl 0xcf8 0x80001068 inb 0xcfc outl 0xcf8 0x8000106a inw 0xcfc outl 0xcf8 0x8000106a outw 0xcfc 0x800e outl 0xcf8 0x8000106c inl 0xcfc outl 0xcf8 0x80001010 outl 0xcfc 0xffffffff outl 0xcf8 0x80001010 inl 0xcfc outl 0xcf8 0x80001010 outl 0xcfc 0xe0080000 outl 0xcf8 0x80001070 inl 0xcfc outb 0xc03d 0x0d outw 0xc03e 0x377a outb 0xc040 0x5 outb 0xc03d 0x0d outw 0xc03e 0x377a outb 0xc040 0x5 outb 0xc03d 0x64 outw 0xc03e 0xb98b outb 0xc040 0x2c inl 0xc02d writeb 0xe00807b1 0x6b outb 0xc03d 0x87 outw 0xc03e 0x6069 outb 0xc040 0x16 write 0x1f 0x2 0xd908 write 0x515 0x2 0xd908 writel 0xe0070637 0x4f583cf outb 0xc0bf 0xbc outw 0xc0c0 0x8ae2 outb 0xc0c2 0x70 write 0x6 0xc 0x0d3cac703662273f51a83937 write 0x13 0xc 0x0d3cac703662273f51a83937 outb 0xc03d 0x87 outw 0xc03e 0x6069 outb 0xc040 0x16 write 0x27 0xa 0x616f00bb06a6422f0f30 write 0x37 0xa 0x616f00bb06a6422f0f30 write 0x47 0xa 0x616f00bb06a6422f0f30 write 0x57 0xa 0x616f00bb06a6422f0f30 write 0x67 0xa 0x616f00bb06a6422f0f30 write 0x77 0xa 0x616f00bb06a6422f0f30 write 0x87 0xa 0x616f00bb06a6422f0f30 write 0x97 0xa 0x616f00bb06a6422f0f30 write 0xa7 0xa 0x616f00bb06a6422f0f30 write 0xb7 0xa 0x616f00bb06a6422f0f30 write 0xc7 0xa 0x616f00bb06a6422f0f30 write 0xd7 0xa 0x616f00bb06a6422f0f30 write 0xe7 0xa 0x616f00bb06a6422f0f30 write 0xf7 0xa 0x616f00bb06a6422f0f30 write 0x107 0xa 0x616f00bb06a6422f0f30 write 0x117 0xa 0x616f00bb06a6422f0f30 write 0x127 0xa 0x616f00bb06a6422f0f30 write 0x137 0xa 0x616f00bb06a6422f0f30 write 0x147 0xa 0x616f00bb06a6422f0f30 write 0x157 0xa 0x616f00bb06a6422f0f30 write 0x167 0xa 0x616f00bb06a6422f0f30 write 0x177 0xa 0x616f00bb06a6422f0f30 write 0x187 0xa 0x616f00bb06a6422f0f30 write 0x197 0xa 0x616f00bb06a6422f0f30 write 0x1a7 0xa 0x616f00bb06a6422f0f30 write 0x1b7 0xa 0x616f00bb06a6422f0f30 write 0x1c7 0xa 0x616f00bb06a6422f0f30 write 0x1d7 0xa 0x616f00bb06a6422f0f30 write 0x1e7 0xa 0x616f00bb06a6422f0f30 write 0x1f7 0xa 0x616f00bb06a6422f0f30 write 0x207 0xa 0x616f00bb06a6422f0f30 write 0x217 0xa 0x616f00bb06a6422f0f30 write 0x227 0xa 0x616f00bb06a6422f0f30 write 0x237 0xa 0x616f00bb06a6422f0f30 write 0x247 0xa 0x616f00bb06a6422f0f30 write 0x257 0xa 0x616f00bb06a6422f0f30 write 0x267 0xa 0x616f00bb06a6422f0f30 write 0x277 0xa 0x616f00bb06a6422f0f30 write 0x287 0xa 0x616f00bb06a6422f0f30 write 0x297 0xa 0x616f00bb06a6422f0f30 write 0x2a7 0xa 0x616f00bb06a6422f0f30 write 0x2b7 0xa 0x616f00bb06a6422f0f30 write 0x2c7 0xa 0x616f00bb06a6422f0f30 write 0x2d7 0xa 0x616f00bb06a6422f0f30 write 0x2e7 0xa 0x616f00bb06a6422f0f30 write 0x2f7 0xa 0x616f00bb06a6422f0f30 write 0x307 0xa 0x616f00bb06a6422f0f30 write 0x317 0xa 0x616f00bb06a6422f0f30 write 0x327 0xa 0x616f00bb06a6422f0f30 write 0x337 0xa 0x616f00bb06a6422f0f30 write 0x347 0xa 0x616f00bb06a6422f0f30 write 0x357 0xa 0x616f00bb06a6422f0f30 write 0x367 0xa 0x616f00bb06a6422f0f30 write 0x377 0xa 0x616f00bb06a6422f0f30 write 0x387 0xa 0x616f00bb06a6422f0f30 write 0x397 0xa 0x616f00bb06a6422f0f30 write 0x3a7 0xa 0x616f00bb06a6422f0f30 write 0x3b7 0xa 0x616f00bb06a6422f0f30 write 0x3c7 0xa 0x616f00bb06a6422f0f30 write 0x3d7 0xa 0x616f00bb06a6422f0f30 write 0x3e7 0xa 0x616f00bb06a6422f0f30 write 0x3f7 0xa 0x616f00bb06a6422f0f30 write 0x407 0xa 0x616f00bb06a6422f0f30 write 0x417 0xa 0x616f00bb06a6422f0f30 write 0x427 0xa 0x616f00bb06a6422f0f30 write 0x437 0xa 0x616f00bb06a6422f0f30 write 0x447 0xa 0x616f00bb06a6422f0f30 write 0x457 0xa 0x616f00bb06a6422f0f30 write 0x467 0xa 0x616f00bb06a6422f0f30 write 0x477 0xa 0x616f00bb06a6422f0f30 write 0x487 0xa 0x616f00bb06a6422f0f30 write 0x497 0xa 0x616f00bb06a6422f0f30 write 0x4a7 0xa 0x616f00bb06a6422f0f30 write 0x4b7 0xa 0x616f00bb06a6422f0f30 write 0x4c7 0xa 0x616f00bb06a6422f0f30 write 0x4d7 0xa 0x616f00bb06a6422f0f30 write 0x4e7 0xa 0x616f00bb06a6422f0f30 write 0x4f7 0xa 0x616f00bb06a6422f0f30 write 0x507 0xa 0x616f00bb06a6422f0f30 write 0x517 0xa 0x616f00bb06a6422f0f30 write 0x527 0xa 0x616f00bb06a6422f0f30 write 0x537 0xa 0x616f00bb06a6422f0f30 write 0x547 0xa 0x616f00bb06a6422f0f30 write 0x557 0xa 0x616f00bb06a6422f0f30 write 0x567 0xa 0x616f00bb06a6422f0f30 write 0x577 0xa 0x616f00bb06a6422f0f30 write 0x587 0xa 0x616f00bb06a6422f0f30 write 0x597 0xa 0x616f00bb06a6422f0f30 write 0x5a7 0xa 0x616f00bb06a6422f0f30 write 0x5b7 0xa 0x616f00bb06a6422f0f30 write 0x5c7 0xa 0x616f00bb06a6422f0f30 write 0x5d7 0xa 0x616f00bb06a6422f0f30 write 0x5e7 0xa 0x616f00bb06a6422f0f30 write 0x5f7 0xa 0x616f00bb06a6422f0f30 write 0x607 0xa 0x616f00bb06a6422f0f30 outb 0xc03d 0x0d outw 0xc03e 0x377a outb 0xc040 0x5 outb 0xc03d 0x87 outw 0xc03e 0x6069 outb 0xc040 0x16 write 0xd93739a8513f2764 0x2 0x373b outb 0xc03d 0xbd outw 0xc03e 0x3ac5 outb 0xc040 0x1 writeq 0xe0080710 0x3bd756a5 outb 0xc0bf 0xbc outw 0xc0c0 0x8ae2 outb 0xc0c2 0x70 write 0xd93739a8513f2764 0x2 0x0d3c write 0xd93739a8513f2765 0x1 0x0d outb 0xc0bf 0xbc outw 0xc0c0 0x8ae2 outb 0xc0c2 0x70 outb 0xc03d 0x87 outw 0xc03e 0x6069 outb 0xc040 0x16 outb 0xc03d 0x87 outw 0xc03e 0x6069 outb 0xc040 0x16 outl 0xc020 0x31d208f7 outw 0xc034 0xf409 outb 0xc0bf 0xbc outw 0xc0c0 0x8ae2 outb 0xc0c2 0x70 write 0x9 0x3 0x84e1fe write 0x10 0x3 0x84e1fe write 0x17 0x3 0x84e1fe write 0x1e 0x2 0x84e1 write 0x1 0x2 0x8271 write 0x17 0x2 0x8271 outb 0xc03d 0x0d outw 0xc03e 0x377a outb 0xc040 0x5 outb 0xc03d 0x87 outw 0xc03e 0x6069 outb 0xc040 0x16 write 0x27 0xa 0x616f00bb06a6422f0f30 write 0x6d1 0xa 0x616f00bb06a6422f0f30 readb 0xe0083d93 outb 0xc03d 0x87 outw 0xc03e 0x6069 outb 0xc040 0x16 outb 0xc03d 0x87 outw 0xc03e 0x6069 outb 0xc040 0x16 write 0x27 0xa 0x616f00bb06a6422f0f30 write 0x37 0xa 0x616f00bb06a6422f0f30 write 0x47 0xa 0x616f00bb06a6422f0f30 write 0x57 0xa 0x616f00bb06a6422f0f30 write 0x67 0xa 0x616f00bb06a6422f0f30 write 0x77 0xa 0x616f00bb06a6422f0f30 write 0x87 0xa 0x616f00bb06a6422f0f30 write 0x97 0xa 0x616f00bb06a6422f0f30 write 0xa7 0xa 0x616f00bb06a6422f0f30 write 0xb7 0xa 0x616f00bb06a6422f0f30 write 0xc7 0xa 0x616f00bb06a6422f0f30 write 0xd7 0xa 0x616f00bb06a6422f0f30 write 0xe7 0xa 0x616f00bb06a6422f0f30 write 0xf7 0xa 0x616f00bb06a6422f0f30 write 0x107 0xa 0x616f00bb06a6422f0f30 write 0x117 0xa 0x616f00bb06a6422f0f30 write 0x127 0xa 0x616f00bb06a6422f0f30 write 0x137 0xa 0x616f00bb06a6422f0f30 write 0x147 0xa 0x616f00bb06a6422f0f30 write 0x157 0xa 0x616f00bb06a6422f0f30 write 0x167 0xa 0x616f00bb06a6422f0f30 write 0x177 0xa 0x616f00bb06a6422f0f30 write 0x187 0xa 0x616f00bb06a6422f0f30 write 0x197 0xa 0x616f00bb06a6422f0f30 write 0x1a7 0xa 0x616f00bb06a6422f0f30 write 0x1b7 0xa 0x616f00bb06a6422f0f30 write 0x1c7 0xa 0x616f00bb06a6422f0f30 write 0x1d7 0xa 0x616f00bb06a6422f0f30 write 0x1e7 0xa 0x616f00bb06a6422f0f30 write 0x1f7 0xa 0x616f00bb06a6422f0f30 write 0x207 0xa 0x616f00bb06a6422f0f30 write 0x217 0xa 0x616f00bb06a6422f0f30 write 0x227 0xa 0x616f00bb06a6422f0f30 write 0x237 0xa 0x616f00bb06a6422f0f30 write 0x247 0xa 0x616f00bb06a6422f0f30 write 0x257 0xa 0x616f00bb06a6422f0f30 write 0x267 0xa 0x616f00bb06a6422f0f30 write 0x277 0xa 0x616f00bb06a6422f0f30 write 0x287 0xa 0x616f00bb06a6422f0f30 write 0x297 0xa 0x616f00bb06a6422f0f30 write 0x2a7 0xa 0x616f00bb06a6422f0f30 write 0x2b7 0xa 0x616f00bb06a6422f0f30 write 0x2c7 0xa 0x616f00bb06a6422f0f30 write 0x2d7 0xa 0x616f00bb06a6422f0f30 write 0x2e7 0xa 0x616f00bb06a6422f0f30 write 0x2f7 0xa 0x616f00bb06a6422f0f30 write 0x307 0xa 0x616f00bb06a6422f0f30 write 0x317 0xa 0x616f00bb06a6422f0f30 write 0x327 0xa 0x616f00bb06a6422f0f30 write 0x337 0xa 0x616f00bb06a6422f0f30 write 0x347 0xa 0x616f00bb06a6422f0f30 write 0x357 0xa 0x616f00bb06a6422f0f30 write 0x367 0xa 0x616f00bb06a6422f0f30 write 0x377 0xa 0x616f00bb06a6422f0f30 write 0x387 0xa 0x616f00bb06a6422f0f30 write 0x397 0xa 0x616f00bb06a6422f0f30 write 0x3a7 0xa 0x616f00bb06a6422f0f30 write 0x3b7 0xa 0x616f00bb06a6422f0f30 write 0x3c7 0xa 0x616f00bb06a6422f0f30 write 0x3d7 0xa 0x616f00bb06a6422f0f30 write 0x3e7 0xa 0x616f00bb06a6422f0f30 write 0x3f7 0xa 0x616f00bb06a6422f0f30 write 0x407 0xa 0x616f00bb06a6422f0f30 write 0x417 0xa 0x616f00bb06a6422f0f30 write 0x427 0xa 0x616f00bb06a6422f0f30 write 0x437 0xa 0x616f00bb06a6422f0f30 write 0x447 0xa 0x616f00bb06a6422f0f30 write 0x457 0xa 0x616f00bb06a6422f0f30 write 0x467 0xa 0x616f00bb06a6422f0f30 write 0x477 0xa 0x616f00bb06a6422f0f30 write 0x487 0xa 0x616f00bb06a6422f0f30 write 0x497 0xa 0x616f00bb06a6422f0f30 write 0x4a7 0xa 0x616f00bb06a6422f0f30 write 0x4b7 0xa 0x616f00bb06a6422f0f30 write 0x4c7 0xa 0x616f00bb06a6422f0f30 write 0x4d7 0xa 0x616f00bb06a6422f0f30 write 0x4e7 0xa 0x616f00bb06a6422f0f30 write 0x4f7 0xa 0x616f00bb06a6422f0f30 write 0x507 0xa 0x616f00bb06a6422f0f30 write 0x517 0xa 0x616f00bb06a6422f0f30 write 0x527 0xa 0x616f00bb06a6422f0f30 write 0x537 0xa 0x616f00bb06a6422f0f30 write 0x547 0xa 0x616f00bb06a6422f0f30 write 0x557 0xa 0x616f00bb06a6422f0f30 write 0x567 0xa 0x616f00bb06a6422f0f30 write 0x577 0xa 0x616f00bb06a6422f0f30 write 0x587 0xa 0x616f00bb06a6422f0f30 write 0x597 0xa 0x616f00bb06a6422f0f30 write 0x5a7 0xa 0x616f00bb06a6422f0f30 write 0x5b7 0xa 0x616f00bb06a6422f0f30 write 0x5c7 0xa 0x616f00bb06a6422f0f30 write 0x5d7 0xa 0x616f00bb06a6422f0f30 write 0x5e7 0xa 0x616f00bb06a6422f0f30 write 0x5f7 0xa 0x616f00bb06a6422f0f30 write 0x607 0xa 0x616f00bb06a6422f0f30 outw 0xc034 0xf409 outb 0xc03d 0x87 outw 0xc03e 0x6069 outb 0xc040 0x16 write 0x27 0x6 0x41d7582cd6b2 write 0x37 0x6 0x41d7582cd6b2 write 0x47 0x6 0x41d7582cd6b2 write 0x57 0x6 0x41d7582cd6b2 write 0x67 0x6 0x41d7582cd6b2 write 0x77 0x6 0x41d7582cd6b2 write 0x87 0x6 0x41d7582cd6b2 write 0x97 0x6 0x41d7582cd6b2 write 0xa7 0x6 0x41d7582cd6b2 write 0xb7 0x6 0x41d7582cd6b2 write 0xc7 0x6 0x41d7582cd6b2 write 0xd7 0x6 0x41d7582cd6b2 write 0xe7 0x6 0x41d7582cd6b2 write 0xf7 0x6 0x41d7582cd6b2 write 0x107 0x6 0x41d7582cd6b2 write 0x117 0x6 0x41d7582cd6b2 write 0x127 0x6 0x41d7582cd6b2 write 0x137 0x6 0x41d7582cd6b2 write 0x147 0x6 0x41d7582cd6b2 write 0x157 0x6 0x41d7582cd6b2 write 0x167 0x6 0x41d7582cd6b2 write 0x177 0x6 0x41d7582cd6b2 write 0x187 0x6 0x41d7582cd6b2 write 0x197 0x6 0x41d7582cd6b2 write 0x1a7 0x6 0x41d7582cd6b2 write 0x1b7 0x6 0x41d7582cd6b2 write 0x1c7 0x6 0x41d7582cd6b2 write 0x1d7 0x6 0x41d7582cd6b2 write 0x1e7 0x6 0x41d7582cd6b2 write 0x1f7 0x6 0x41d7582cd6b2 write 0x207 0x6 0x41d7582cd6b2 write 0x217 0x6 0x41d7582cd6b2 write 0x227 0x6 0x41d7582cd6b2 write 0x237 0x6 0x41d7582cd6b2 write 0x247 0x6 0x41d7582cd6b2 write 0x257 0x6 0x41d7582cd6b2 write 0x267 0x6 0x41d7582cd6b2 write 0x277 0x6 0x41d7582cd6b2 write 0x287 0x6 0x41d7582cd6b2 write 0x297 0x6 0x41d7582cd6b2 write 0x2a7 0x6 0x41d7582cd6b2 write 0x2b7 0x6 0x41d7582cd6b2 write 0x2c7 0x6 0x41d7582cd6b2 write 0x2d7 0x6 0x41d7582cd6b2 write 0x2e7 0x6 0x41d7582cd6b2 write 0x2f7 0x6 0x41d7582cd6b2 write 0x307 0x6 0x41d7582cd6b2 write 0x317 0x6 0x41d7582cd6b2 write 0x327 0x6 0x41d7582cd6b2 write 0x337 0x6 0x41d7582cd6b2 write 0x347 0x6 0x41d7582cd6b2 write 0x357 0x6 0x41d7582cd6b2 write 0x367 0x6 0x41d7582cd6b2 write 0x377 0x6 0x41d7582cd6b2 write 0x387 0x6 0x41d7582cd6b2 write 0x397 0x6 0x41d7582cd6b2 write 0x3a7 0x6 0x41d7582cd6b2 write 0x3b7 0x6 0x41d7582cd6b2 write 0x3c7 0x6 0x41d7582cd6b2 write 0x3d7 0x6 0x41d7582cd6b2 write 0x3e7 0x6 0x41d7582cd6b2 write 0x3f7 0x6 0x41d7582cd6b2 write 0x407 0x6 0x41d7582cd6b2 write 0x417 0x6 0x41d7582cd6b2 write 0x427 0x6 0x41d7582cd6b2 write 0x437 0x6 0x41d7582cd6b2 write 0x447 0x6 0x41d7582cd6b2 write 0x457 0x6 0x41d7582cd6b2 write 0x467 0x6 0x41d7582cd6b2 write 0x477 0x6 0x41d7582cd6b2 write 0x487 0x6 0x41d7582cd6b2 write 0x497 0x6 0x41d7582cd6b2 write 0x4a7 0x6 0x41d7582cd6b2 write 0x4b7 0x6 0x41d7582cd6b2 write 0x4c7 0x6 0x41d7582cd6b2 write 0x4d7 0x6 0x41d7582cd6b2 write 0x4e7 0x6 0x41d7582cd6b2 write 0x4f7 0x6 0x41d7582cd6b2 write 0x507 0x6 0x41d7582cd6b2 write 0x517 0x6 0x41d7582cd6b2 write 0x527 0x6 0x41d7582cd6b2 write 0x537 0x6 0x41d7582cd6b2 write 0x547 0x6 0x41d7582cd6b2 write 0x557 0x6 0x41d7582cd6b2 write 0x567 0x6 0x41d7582cd6b2 write 0x577 0x6 0x41d7582cd6b2 write 0x587 0x6 0x41d7582cd6b2 write 0x597 0x6 0x41d7582cd6b2 write 0x5a7 0x6 0x41d7582cd6b2 write 0x5b7 0x6 0x41d7582cd6b2 write 0x5c7 0x6 0x41d7582cd6b2 write 0x5d7 0x6 0x41d7582cd6b2 write 0x5e7 0x6 0x41d7582cd6b2 write 0x5f7 0x6 0x41d7582cd6b2 write 0x607 0x6 0x41d7582cd6b2 outb 0xc0bf 0xbc outw 0xc0c0 0x8ae2 outb 0xc0c2 0x70 write 0xe18439a8513ffe73 0x1 0x0d write 0xe18439a8513ffe74 0x1 0x3c write 0xe18439a8513ffe74 0x1 0x0d write 0xe18439a8513ffe72 0x2 0xe5bc write 0xe18439a8513ffe74 0x1 0x1f write 0xe18439a8513ffe74 0x1 0xe5 outw 0xc01e 0xa748 outw 0xc020 0x66c7 readb 0xe008301c outw 0xc01e 0xa748 outw 0xc020 0x66c7 outl 0xc034 0x1f1003d8 outb 0xc034 0x0 outb 0xc03d 0xbd outw 0xc03e 0x3ac5 outb 0xc040 0x1 write 0xe 0x2 0x8582 outb 0xc03d 0x87 outw 0xc03e 0x6069 outb 0xc040 0x16 write 0x27 0xa 0x616f00bb06a6422f0f30 write 0x37 0xa 0x616f00bb06a6422f0f30 write 0x47 0xa 0x616f00bb06a6422f0f30 write 0x57 0xa 0x616f00bb06a6422f0f30 write 0x67 0xa 0x616f00bb06a6422f0f30 write 0x77 0xa 0x616f00bb06a6422f0f30 write 0x87 0xa 0x616f00bb06a6422f0f30 write 0x97 0xa 0x616f00bb06a6422f0f30 write 0xa7 0xa 0x616f00bb06a6422f0f30 write 0xb7 0xa 0x616f00bb06a6422f0f30 write 0xc7 0xa 0x616f00bb06a6422f0f30 write 0xd7 0xa 0x616f00bb06a6422f0f30 write 0xe7 0xa 0x616f00bb06a6422f0f30 write 0xf7 0xa 0x616f00bb06a6422f0f30 write 0x107 0xa 0x616f00bb06a6422f0f30 write 0x117 0xa 0x616f00bb06a6422f0f30 write 0x127 0xa 0x616f00bb06a6422f0f30 write 0x137 0xa 0x616f00bb06a6422f0f30 write 0x147 0xa 0x616f00bb06a6422f0f30 write 0x157 0xa 0x616f00bb06a6422f0f30 write 0x167 0xa 0x616f00bb06a6422f0f30 write 0x177 0xa 0x616f00bb06a6422f0f30 write 0x187 0xa 0x616f00bb06a6422f0f30 write 0x197 0xa 0x616f00bb06a6422f0f30 write 0x1a7 0xa 0x616f00bb06a6422f0f30 write 0x1b7 0xa 0x616f00bb06a6422f0f30 write 0x1c7 0xa 0x616f00bb06a6422f0f30 write 0x1d7 0xa 0x616f00bb06a6422f0f30 write 0x1e7 0xa 0x616f00bb06a6422f0f30 write 0x1f7 0xa 0x616f00bb06a6422f0f30 write 0x207 0xa 0x616f00bb06a6422f0f30 write 0x217 0xa 0x616f00bb06a6422f0f30 write 0x227 0xa 0x616f00bb06a6422f0f30 write 0x237 0xa 0x616f00bb06a6422f0f30 write 0x247 0xa 0x616f00bb06a6422f0f30 write 0x257 0xa 0x616f00bb06a6422f0f30 write 0x267 0xa 0x616f00bb06a6422f0f30 write 0x277 0xa 0x616f00bb06a6422f0f30 write 0x287 0xa 0x616f00bb06a6422f0f30 write 0x297 0xa 0x616f00bb06a6422f0f30 write 0x2a7 0xa 0x616f00bb06a6422f0f30 write 0x2b7 0xa 0x616f00bb06a6422f0f30 write 0x2c7 0xa 0x616f00bb06a6422f0f30 write 0x2d7 0xa 0x616f00bb06a6422f0f30 write 0x2e7 0xa 0x616f00bb06a6422f0f30 write 0x2f7 0xa 0x616f00bb06a6422f0f30 write 0x307 0xa 0x616f00bb06a6422f0f30 write 0x317 0xa 0x616f00bb06a6422f0f30 write 0x327 0xa 0x616f00bb06a6422f0f30 write 0x337 0xa 0x616f00bb06a6422f0f30 write 0x347 0xa 0x616f00bb06a6422f0f30 write 0x357 0xa 0x616f00bb06a6422f0f30 write 0x367 0xa 0x616f00bb06a6422f0f30 write 0x377 0xa 0x616f00bb06a6422f0f30 write 0x387 0xa 0x616f00bb06a6422f0f30 write 0x397 0xa 0x616f00bb06a6422f0f30 write 0x3a7 0xa 0x616f00bb06a6422f0f30 write 0x3b7 0xa 0x616f00bb06a6422f0f30 write 0x3c7 0xa 0x616f00bb06a6422f0f30 write 0x3d7 0xa 0x616f00bb06a6422f0f30 write 0x3e7 0xa 0x616f00bb06a6422f0f30 write 0x3f7 0xa 0x616f00bb06a6422f0f30 write 0x407 0xa 0x616f00bb06a6422f0f30 write 0x417 0xa 0x616f00bb06a6422f0f30 write 0x427 0xa 0x616f00bb06a6422f0f30 write 0x437 0xa 0x616f00bb06a6422f0f30 write 0x447 0xa 0x616f00bb06a6422f0f30 write 0x457 0xa 0x616f00bb06a6422f0f30 write 0x467 0xa 0x616f00bb06a6422f0f30 write 0x477 0xa 0x616f00bb06a6422f0f30 write 0x487 0xa 0x616f00bb06a6422f0f30 write 0x497 0xa 0x616f00bb06a6422f0f30 write 0x4a7 0xa 0x616f00bb06a6422f0f30 write 0x4b7 0xa 0x616f00bb06a6422f0f30 write 0x4c7 0xa 0x616f00bb06a6422f0f30 write 0x4d7 0xa 0x616f00bb06a6422f0f30 write 0x4e7 0xa 0x616f00bb06a6422f0f30 write 0x4f7 0xa 0x616f00bb06a6422f0f30 write 0x507 0xa 0x616f00bb06a6422f0f30 write 0x517 0xa 0x616f00bb06a6422f0f30 write 0x527 0xa 0x616f00bb06a6422f0f30 write 0x537 0xa 0x616f00bb06a6422f0f30 write 0x547 0xa 0x616f00bb06a6422f0f30 write 0x557 0xa 0x616f00bb06a6422f0f30 write 0x567 0xa 0x616f00bb06a6422f0f30 write 0x577 0xa 0x616f00bb06a6422f0f30 write 0x587 0xa 0x616f00bb06a6422f0f30 write 0x597 0xa 0x616f00bb06a6422f0f30 write 0x5a7 0xa 0x616f00bb06a6422f0f30 write 0x5b7 0xa 0x616f00bb06a6422f0f30 write 0x5c7 0xa 0x616f00bb06a6422f0f30 write 0x5d7 0xa 0x616f00bb06a6422f0f30 write 0x5e7 0xa 0x616f00bb06a6422f0f30 write 0x5f7 0xa 0x616f00bb06a6422f0f30 write 0x607 0xa 0x616f00bb06a6422f0f30 outb 0xc03d 0x87 outw 0xc03e 0x6069 outb 0xc040 0x16 outb 0xc03d 0x87 outw 0xc03e 0x6069 outb 0xc040 0x16 write 0x27 0x6 0x41d7582cd6b2 write 0x37 0x6 0x41d7582cd6b2 write 0x47 0x6 0x41d7582cd6b2 write 0x57 0x6 0x41d7582cd6b2 write 0x67 0x6 0x41d7582cd6b2 write 0x77 0x6 0x41d7582cd6b2 write 0x87 0x6 0x41d7582cd6b2 write 0x97 0x6 0x41d7582cd6b2 write 0xa7 0x6 0x41d7582cd6b2 write 0xb7 0x6 0x41d7582cd6b2 write 0xc7 0x6 0x41d7582cd6b2 write 0xd7 0x6 0x41d7582cd6b2 write 0xe7 0x6 0x41d7582cd6b2 write 0xf7 0x6 0x41d7582cd6b2 write 0x107 0x6 0x41d7582cd6b2 write 0x117 0x6 0x41d7582cd6b2 write 0x127 0x6 0x41d7582cd6b2 write 0x137 0x6 0x41d7582cd6b2 write 0x147 0x6 0x41d7582cd6b2 write 0x157 0x6 0x41d7582cd6b2 write 0x167 0x6 0x41d7582cd6b2 write 0x177 0x6 0x41d7582cd6b2 write 0x187 0x6 0x41d7582cd6b2 write 0x197 0x6 0x41d7582cd6b2 write 0x1a7 0x6 0x41d7582cd6b2 write 0x1b7 0x6 0x41d7582cd6b2 write 0x1c7 0x6 0x41d7582cd6b2 write 0x1d7 0x6 0x41d7582cd6b2 write 0x1e7 0x6 0x41d7582cd6b2 write 0x1f7 0x6 0x41d7582cd6b2 write 0x207 0x6 0x41d7582cd6b2 write 0x217 0x6 0x41d7582cd6b2 write 0x227 0x6 0x41d7582cd6b2 write 0x237 0x6 0x41d7582cd6b2 write 0x247 0x6 0x41d7582cd6b2 write 0x257 0x6 0x41d7582cd6b2 write 0x267 0x6 0x41d7582cd6b2 write 0x277 0x6 0x41d7582cd6b2 write 0x287 0x6 0x41d7582cd6b2 write 0x297 0x6 0x41d7582cd6b2 write 0x2a7 0x6 0x41d7582cd6b2 write 0x2b7 0x6 0x41d7582cd6b2 write 0x2c7 0x6 0x41d7582cd6b2 write 0x2d7 0x6 0x41d7582cd6b2 write 0x2e7 0x6 0x41d7582cd6b2 write 0x2f7 0x6 0x41d7582cd6b2 write 0x307 0x6 0x41d7582cd6b2 write 0x317 0x6 0x41d7582cd6b2 write 0x327 0x6 0x41d7582cd6b2 write 0x337 0x6 0x41d7582cd6b2 write 0x347 0x6 0x41d7582cd6b2 write 0x357 0x6 0x41d7582cd6b2 write 0x367 0x6 0x41d7582cd6b2 write 0x377 0x6 0x41d7582cd6b2 write 0x387 0x6 0x41d7582cd6b2 write 0x397 0x6 0x41d7582cd6b2 write 0x3a7 0x6 0x41d7582cd6b2 write 0x3b7 0x6 0x41d7582cd6b2 write 0x3c7 0x6 0x41d7582cd6b2 write 0x3d7 0x6 0x41d7582cd6b2 write 0x3e7 0x6 0x41d7582cd6b2 write 0x3f7 0x6 0x41d7582cd6b2 write 0x407 0x6 0x41d7582cd6b2 write 0x417 0x6 0x41d7582cd6b2 write 0x427 0x6 0x41d7582cd6b2 write 0x437 0x6 0x41d7582cd6b2 write 0x447 0x6 0x41d7582cd6b2 write 0x457 0x6 0x41d7582cd6b2 write 0x467 0x6 0x41d7582cd6b2 write 0x477 0x6 0x41d7582cd6b2 write 0x487 0x6 0x41d7582cd6b2 write 0x497 0x6 0x41d7582cd6b2 write 0x4a7 0x6 0x41d7582cd6b2 write 0x4b7 0x6 0x41d7582cd6b2 write 0x4c7 0x6 0x41d7582cd6b2 write 0x4d7 0x6 0x41d7582cd6b2 write 0x4e7 0x6 0x41d7582cd6b2 write 0x4f7 0x6 0x41d7582cd6b2 write 0x507 0x6 0x41d7582cd6b2 write 0x517 0x6 0x41d7582cd6b2 write 0x527 0x6 0x41d7582cd6b2 write 0x537 0x6 0x41d7582cd6b2 write 0x547 0x6 0x41d7582cd6b2 write 0x557 0x6 0x41d7582cd6b2 write 0x567 0x6 0x41d7582cd6b2 write 0x577 0x6 0x41d7582cd6b2 write 0x587 0x6 0x41d7582cd6b2 write 0x597 0x6 0x41d7582cd6b2 write 0x5a7 0x6 0x41d7582cd6b2 write 0x5b7 0x6 0x41d7582cd6b2 write 0x5c7 0x6 0x41d7582cd6b2 write 0x5d7 0x6 0x41d7582cd6b2 write 0x5e7 0x6 0x41d7582cd6b2 write 0x5f7 0x6 0x41d7582cd6b2 write 0x607 0x6 0x41d7582cd6b2 writeq 0xe0083804 0x1f1003d8 inl 0xc03d inl 0xc03d inl 0xc01e inl 0xc03d inl 0xc0bf outw 0xc012 0x14eb inl 0xc0bf writew 0xe008308d 0x3318 inl 0xc03d outl 0xc0c0 0x3a9203d0 writel 0xe0082ff1 0x31dda7ca outb 0xc03f 0x60 outw 0xc040 0x3297 outb 0xc042 0x5e outb 0xc03d 0x87 outw 0xc03e 0x6069 outb 0xc040 0x16 outb 0xc03d 0x87 outw 0xc03e 0x6069 outb 0xc040 0x16 inb 0xc0db writeb 0xe007d83b 0x44 inl 0xc09d inw 0xc091 outb 0xc03d 0x87 outw 0xc03e 0x6069 outb 0xc040 0x16 readl 0xe0082030 outw 0xc01e 0xa748 outw 0xc020 0x66c7 EOF ``` 3. QEMU crashes with the SEGV shown above. The crash is deterministic: 5/5 runs on `v11.0.0`, each in under a second. The same backtrace also appears on a master snapshot (`v11.0.0-1846-gec6a1f4398`).