=== DF-0055 baseline reproduction on UNPATCHED kernel #0 ===
Guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
PoC: udev_uaf (two /dev/udev readers + tap create/destroy event generator)
Run as: root (uid 0) -- /dev/udev is 0600 root:wheel

--- stdout (before panic killed ssh) ---
[*] DF-0055: udev_event_externalize shared-dict UAF trigger
[*] forking two /dev/udev readers (two softcs/markers)...
[*] generating device attach/detach events (tap create/destroy)...
[*] each event is externalized by reader #1 (frees shared dict),
    then by reader #2 (UAF: prop_object_retain on freed dict).
(SSH timed out at 25s; guest went DOWN -> kernel panicked)

--- guest status after run ---
down  (vm.sh status)

--- panic signature from dfbsd-qemu/boot.log (lines 217-231) ---
panic: assertion "ocnt != 0" failed in prop_object_release at /usr/src/sys/libprop/prop_object.c:1085
cpuid = 1
Trace beginning at frame 0xfffff801181874c8
prop_object_release() at prop_object_release+0x277 0xffffffff809e1927
prop_object_release() at prop_object_release+0x277 0xffffffff809e1927
udev_dev_read() at udev_dev_read+0x162 0xffffffff80663fe2
dev_dread() at dev_dread+0xa3 0xffffffff8062cc73
devfs_fo_read() at devfs_fo_read+0x100 0xffffffff80922220
kern_preadv() at kern_preadv()+0x1e5 0xffffffff806a7395
Debugger("panic")

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      Debugger+0x7c:  movb    $0xbdaf09(%rip)
db>

BASELINE CONFIRMED: deterministic kernel panic (DoS) on unpatched #0 kernel,
exact cited path udev_dev_read -> udev_event_externalize -> prop_object_release.