DF-0003 panic signature -- captured from dfbsd-qemu/boot.log (serial console)
after `kldload poc_negunit.ko` (module whose only action is
device_add_child(root_bus, "df3neg", -2)).

The crash is the exact OOB-write sink cited in the finding:
  sys/kern/subr_bus.c:1144   dc->devices[dev->unit] = dev;

Unpatched baseline kernel: DragonFly 6.5-DEVELOPMENT #0 (Thu Jul  2 06:02:54 UTC 2026)
Fault IP 0xffffffff8068b236 = devclass_add_device base + 0xf6
(prior #1 build of same source had base+offset 0xffffffff8068a946 -- identical offset +0xf6)

Control (unit=0) loaded cleanly and printed:
  DF0003-CTRL: unit=0 -> OK (child=0xfffff801175bd1e0)  [valid unit: no crash]

Trigger (unit=-2) panicked immediately:
---
Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address	= 0xfffffffffffffff0
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff8068b236
stack pointer	        = 0x10:0xfffff801181b7738
frame pointer	        = 0x10:0xfffff801181b7778
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1445
current thread          = pri 6
kernel: type 12 trap, code=2

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      devclass_add_device+0xf6:       movq    %r14,(%rdx,%rax,1)
db>

FAULT-ADDRESS ARITHMETIC (proves negative-index write):
  fault VA  = 0xfffffffffffffff0 = (device_t *)NULL + (-2) = 0 + (-2)*8
  dev->unit = -2 (returned successfully by devclass_alloc_unit)
  dc->devices == NULL for the freshly-created "df3neg" devclass
  => dc->devices[dev->unit] = dev  writes 8 bytes (the dev pointer) at
     address 0 + (-2)*sizeof(device_t) = 0xfffffffffffffff0  (unmapped) ->
     supervisor WRITE page fault inside devclass_add_device at subr_bus.c:1144.

SYMBOL PROOF (from prior verified run, identical source):
  addr2line -e /boot/kernel/kernel 0xffffffff8068a946 -> sys/kern/subr_bus.c:1144
  nm /boot/kernel/kernel | grep devclass_add_device
  ffffffff8068a850 t devclass_add_device      (base)
  fault IP = base + 0xf6    (offset matches panic string)