Two Addresses, One Page: Finding the Firmware Bug Behind NetBSD Corruption on the Milk-V Mars
NetBSD booted on my Milk-V Mars, joined the network, and then overwrote its own kernel with pkgsrc file data under sustained write load. The evidence first pointed at a double allocation inside UVM. That diagnosis was wrong. A custom PGAUDIT kernel, a Mars-shaped QEMU target, 256 permanent canary pages, and a controlled cache-flush experiment in DDB eventually showed two physical addresses exactly 4 GiB apart reaching the same DDR backing. The unsafe 8 GiB map came from a blank EEPROM and U-Boot SPL's private memory default. This is the sequel to my original bring-up article: the wrong theories, the two device trees hiding in one boot chain, the one-line firmware correction, and the 600-second hardware A/B that contained the corruption.