=== DF-0002 unpatched baseline (#0) — single run ===
host# kldload /root/poc/DF-0002/df0002_trigger.ko
  4    1 0xffffffff82600000     1000 df0002_trigger.ko

host# cd /root/poc/DF-0002 && ./fhopen_spur
[*] v_object nullified on vnode for fd 3 (/tmp/df0002_tmpfs/file)
fhopen returned 0 (success)
BUG: fd 0 is stdin, no real descriptor was allocated

dmesg:
DF-0002: trigger module loaded. sysctl: debug.df0002.corrupt_fd
DF-0002: corrupted vnode 0xfffff80118539080 (cleared v_object, was 0xfffff8008fad4040, type=VREG)
fhopen: regular file did not have VM object: 0xfffff80118539080   <-- the buggy kprintf at vfs_syscalls.c:4934
                                                                 <-- BUT no error is set; sysmsg_result retains the syscall-entry default of 0
                                                                    so the caller sees "success, fd 0" (its own stdin).