=== DF-0070 FIX VALIDATION RUN (patched kernel #1) ===
Patched kernel: DragonFly 6.5-DEVELOPMENT #1: Thu Jul  2 15:29:19 UTC 2026 (X86_64_GENERIC)
kernel.stripped sha256: 65ae8b9ec68b224ec90a7e4044aa869b7bf26e3604b42d3fd436c15638fb5ba3
Command (root):  cd /tmp/df70 && ./df0070 evil.ckpt   (panic mode, n_namesz=0x10000000)

=== Patched run 1 (panic mode) ===
[*] DF-0070 PoC: building evil.ckpt  (notesz=880, n_namesz=0x10000000, n_descsz=120, mode=panic)
[*] calling sys_checkpoint(CKPT_THAW, fd=3, pid=-1, retval=0) [syscall #467]...
[!] sys_checkpoint returned -1, errno=22 (Invalid argument)
RUN_EXIT=1
guest status: up   (NO PANIC)

=== Patched run 2 (panic mode) ===
[!] sys_checkpoint returned -1, errno=22 (Invalid argument)
RUN_EXIT=1
guest status: up

=== Patched run 3 (panic mode) ===
[!] sys_checkpoint returned -1, errno=22 (Invalid argument)
RUN_EXIT=1
guest status: up

=== Patched leak mode (n_namesz=0x35c) ===
[*] DF-0070 PoC: building evil.ckpt  (notesz=880, n_namesz=0x35c, n_descsz=120, mode=leak)
[!] sys_checkpoint returned -1, errno=22 (Invalid argument)
RUN_EXIT=1
guest status: up

=== boot.log panic-line count over all patched runs ===
0   (no 'fatal trap' / 'panic:' / 'db> ' anywhere)

=== Conclusion ===
On the single-fix kernel, elf_getnote's new bounds check (srcsz - *off < sizeof(note),
namesz_pad > srcsz - *off, descsz_pad > srcsz - *off) rejects the malformed first note
before any OOB access: the panic-mode crafted n_namesz=0x10000000 trips
`note.n_namesz > 32` -> EINVAL, and the leak-mode n_namesz=860 (namesz_pad=864) lets the
name advance pass but trips `descsz_pad (120) > srcsz - *off (880-876=4)` -> EINVAL,
stopping the descriptor OOB read at kern_checkpoint.c:346.  CKPT_THAW fails gracefully,
no page fault, guest fully responsive.  Deterministic over 3 panic + 1 leak runs.