=== DF-0005 PoC on single-fix kernel #1 (kern.tty_tiocsti killswitch) ===
DragonFly 6.5-DEVELOPMENT #1: Thu Jul  2 17:36:19 UTC 2026
SHA256 (/boot/kernel/kernel) = 76151248367fac055f1ce8ee3aea35ad0e55a2063d1d0bf48d03d13d19661f38

===== Scenario A: kern.tty_tiocsti=1 (default, historical behavior preserved) =====
kern.tty_tiocsti: 0 -> 1
kern.tty_tiocsti: 1
[*] uid=1001 euid=1001  pty slave=/dev/pts/0
[+] TIOCSTI ioctl succeeded (no EPERM/EACCES) -- guards at tty.c:1160,1167 bypassed for ctty owner
echo TIOCSTI_READBACK_OK
[+] readback from /dev/tty (25 bytes): echo TIOCSTI_READBACK_OK
echo TIOCSTI_EXEC_BY_DOWNSTREAM_SHELL
exit
$ echo TIOCSTI_EXEC_BY_DOWNSTREAM_SHELL
TIOCSTI_EXEC_BY_DOWNSTREAM_SHELL
$ exit
[*] downstream sh exit status: 0
RUN_EXIT=0

===== Scenario B: kern.tty_tiocsti=0 (FIX ACTIVE -> expect EPERM, no injection) =====
kern.tty_tiocsti: 1 -> 0
kern.tty_tiocsti: 0
[*] uid=1001 euid=1001  pty slave=/dev/pts/0
[!] TIOCSTI DENIED: Operation not permitted -- primitive is gated
[*] downstream sh exit status: 1
RUN_EXIT=1

===== Scenario C: gated run #2 (determinism) =====
[*] uid=1001 euid=1001  pty slave=/dev/pts/0
[!] TIOCSTI DENIED: Operation not permitted -- primitive is gated
[*] downstream sh exit status: 1
RUN_EXIT=1

===== Scenario D: gated run #3 (determinism) =====
[*] uid=1001 euid=1001  pty slave=/dev/pts/0
[!] TIOCSTI DENIED: Operation not permitted -- primitive is gated
[*] downstream sh exit status: 1
RUN_EXIT=1

===== Scenario E: toggle back to =1 (compat round-trip -> injection restored) =====
kern.tty_tiocsti: 0 -> 1
kern.tty_tiocsti: 1
[*] uid=1001 euid=1001  pty slave=/dev/pts/0
[+] TIOCSTI ioctl succeeded (no EPERM/EACCES) -- guards at tty.c:1160,1167 bypassed for ctty owner
[+] readback from /dev/tty (25 bytes): echo TIOCSTI_READBACK_OK
echo TIOCSTI_READBACK_OK
echo TIOCSTI_EXEC_BY_DOWNSTREAM_SHELL
exit
$ echo TIOCSTI_EXEC_BY_DOWNSTREAM_SHELL
TIOCSTI_EXEC_BY_DOWNSTREAM_SHELL
$ exit
[*] downstream sh exit status: 0
RUN_EXIT=0

=== guest status at end of fix-run ===
up