########## DF-0010 — guest environment ##########
Tested: 2026-07-02

== UNPATCHED baseline kernel (#0) ==
uname -a:
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
kern.version:
DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026

== SINGLE-FIX kernel (#1) — built + booted for Phase 8 ==
kern.version:
DragonFly 6.5-DEVELOPMENT #1: Thu Jul  2 18:16:59 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC
/boot/kernel/kernel sha256 (after install): 75d02b7bb8ab50709862a35362d4184ae3aafd3fdf70d3fe943ecc9770b73360

== toolchain (root) ==
cc (gcc) 8.3 [DragonFly] Release/2019-02-22

== PoC user ==
uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)   (not in wheel)

== PoC deps ==
socketpair(AF_LOCAL, SOCK_DGRAM) + setsockopt(SO_PASSCRED) + send/recvmsg.
No sysctl/mount/module state required — default kernel, unprivileged self-reachable.

== source verified ==
sys/kern/uipc_usrreq.c:683  ->  struct cmsgcred cred;   (NO initializer, unpatched)
sys/kern/uipc_usrreq.c:686  ->  bzero(&cred, sizeof(cred));   (after fix.diff applied)
sys/kern/uipc_usrreq.c:695  ->  sbcreatecontrol(&cred, sizeof(cred), SCM_CREDS, SOL_SOCKET)
sys/kern/uipc_usrreq.c:1734-1744 -> unp_internalize SCM_CREDS partial fill (tail groups unwritten)