######## DF-0003 BASELINE REPRODUCTION on unpatched #0 kernel ########
# Kernel: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
# (with-src base -- full /usr/src + warm obj + UNPATCHED audit kernel)

######## STEP 1: CONTROL (unit=0) -- expect clean load ########
$ kldload /root/poc_df3/poc_ctrl.ko
KLDLOAD_CTRL_RC=0   (loaded id=4)

boot.log serial delta:
  login: DF0003-CTRL: unit=0 -> OK (child=0xfffff801175bd1e0)  [valid unit: no crash]

guest status after control: up

######## STEP 2: TRIGGER (unit=-2) -- expect kernel panic ########
$ kldload /root/poc_df3/poc_negunit.ko
  (ssh session dies mid-load -- kernel page-faults; panic captured on serial console)
ssh exit: 255 (Connection closed) / run_root hung (guest wedged in DDB)
guest status after trigger: down

boot.log serial delta (the crash):
  Fatal trap 12: page fault while in kernel mode
  cpuid = 1; lapic id = 1
  fault virtual address	= 0xfffffffffffffff0
  fault code		= supervisor write data, page not present
  instruction pointer	= 0x8:0xffffffff8068b236
  stack pointer	        = 0x10:0xfffff801181b7738
  frame pointer	        = 0x10:0xfffff801181b7778
  code segment		= base 0x0, limit 0xfffff, type 0x1b
  			= DPL 0, pres 1, long 1, def32 0, gran 1
  processor eflags	= interrupt enabled, resume, IOPL = 0
  current process		= 1445
  current thread          = pri 6
  kernel: type 12 trap, code=2

  CPU1 stopping CPUs: 0x0000003d
   stopped
  Stopped at      devclass_add_device+0xf6:       movq    %r14,(%rdx,%rax,1)
  db>

FAULT-ADDRESS ARITHMETIC (proves negative-index write at subr_bus.c:1144):
  fault VA  = 0xfffffffffffffff0 = (device_t *)NULL + (-2) = 0 + (-2)*8
  dev->unit = -2 (returned successfully by devclass_alloc_unit)
  dc->devices == NULL for the freshly-created "df3neg" devclass
  => dc->devices[dev->unit] = dev  writes 8 bytes (the dev pointer) at
     address 0 + (-2)*sizeof(device_t) = 0xfffffffffffffff0  (unmapped) ->
     supervisor WRITE page fault inside devclass_add_device at subr_bus.c:1144.

The ONLY difference between control (.ko) and trigger (.ko) is the literal unit
(0 vs -2). Control loads clean; trigger panics at the exact cited sink line.