=== DF-0035 baseline panic (unpatched #0 kernel, decisive PoC, 2026-07-02) ===
Guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 (with-src base)
PoC:   msgbuf_oob_decisive (kvm_write bad geometry + sysctl kern.msgbuf read)

login: panic: assertion "obj != NULL" failed in vm_object_hold_shared at /usr/src/sys/vm/vm_object.c:330
cpuid = 0
Trace beginning at frame 0xfffff801183bf318
vm_object_hold_shared() at vm_object_hold_shared+0x3f 0xffffffff809ab9bf
vm_object_hold_shared() at vm_object_hold_shared+0x3f 0xffffffff809ab9bf
vm_fault() at vm_fault+0x408 0xffffffff8099e0b8
trap_pfault() at trap_pfault+0x9a 0xffffffff80bd52ca
trap() at trap+0x17c 0xffffffff80bd5bcc
calltrap() at calltrap+0x9 0xffffffff80b991fa
--- trap 000000000000000c, rip = ffffffff80bcaeaa, rsp = fffff801183bf730, rbp = fffff801183bf768 ---
std_copyout() at std_copyout+0x15a 0xffffffff80bcaeaa
Debugger("panic")
Stopped at Debugger+0x7c: movb $0,0xbdaf09(%rip)
db>

trap 0xc = page fault raised inside copyout's source-side read, walking past
msg_ptr+msg_size into unmapped adjacent kernel memory. Identical mechanism to
the two prior-session panics in panic.txt (rip offset differs only because of
the #0 vs #1 rebuild addresses).