######## DF-0003 FIX-VALIDATION on patched #1 kernel ########
# Kernel: DragonFly 6.5-DEVELOPMENT #1: Thu Jul  2 12:26:06 UTC 2026
# (with-src base + fix.diff applied: reject unit<-1 in devclass_alloc_unit,
#  reject unit<0 in device_set_unit -- sys/kern/subr_bus.c)
# sha256 /boot/kernel/kernel = d7af64646ad16692c09ed90710cd3e010928e396cac6a657d408319bad48d197

=== STEP 1: CONTROL (unit=0) ===
KLDLOAD_CTRL_RC=0  (loaded; printed DF0003-CTRL: unit=0 -> OK)
guest status after control: up

=== STEP 2: TRIGGER (unit=-2) -- the SAME command that panicked #0 ===
KLDLOAD_TRIG_RC=0  (module loaded; handler reached kprintf -- PROOF the OOB write was averted)
console: DF0003: unit=-2 name="df3neg" -> FAIL/NULL (child=0)
  (device_add_child returned NULL: devclass_alloc_unit now returns EINVAL
   for unit<-1, so make_device fails BEFORE the dc->devices[-2]=dev sink)
guest status after trigger: up   (NO panic)

=== Repeated 3x for determinism (unload + reload) ===
run 2: CTRL_RC=0 TRIG_RC=0 guest=up
run 3: CTRL_RC=0 TRIG_RC=0 guest=up

=== boot.log serial console (all 3 runs) ===
login: DF0003-CTRL: unit=0 -> OK (child=0xfffff801175bac60)  [valid unit: no crash]
DF0003: unit=-2 name="df3neg" -> FAIL/NULL (child=0)
DF0003-CTRL: unit=0 -> OK (child=0xfffff8008bb64320)  [valid unit: no crash]
DF0003: unit=-2 name="df3neg" -> FAIL/NULL (child=0)
DF0003-CTRL: unit=0 -> OK (child=0xfffff801175fd320)  [valid unit: no crash]
DF0003: unit=-2 name="df3neg" -> FAIL/NULL (child=0)

=== panic signature count in boot.log (MUST be 0 for fix to pass) ===
0   (no 'fatal trap' / 'panic:' / 'Stopped at' lines)

=== BEFORE/AFTER CONTRAST ===
BEFORE (unpatched #0): kldload poc_negunit.ko => Fatal trap 12 page fault,
  fault VA 0xfffffffffffffff0, Stopped at devclass_add_device+0xf6 (subr_bus.c:1144)
  guest DOWN in DDB. kprintf never reached.
AFTER  (patched   #1): kldload poc_negunit.ko => RC=0, kprintf reached:
  'unit=-2 -> FAIL/NULL (child=0)', guest UP, 0 panics. Deterministic 3/3.
  => the negative-unit guard closes the OOB-write sink.