=== PATCHED-KERNEL RUN (single-fix kernel #1) ===
$ sysctl -n kern.version | head -1
DragonFly 6.5-DEVELOPMENT #1: Mon Jul 13 00:55:22 UTC 2026
(SHA256 /boot/kernel/kernel = 687b30b9dc3c11d55dc8b958b3e325b9c95a4251e8589649f920bc7cd80480d6)

$ cc -o poc_secsize poc_secsize.c && echo BUILD_OK
BUILD_OK

# fresh scratch vn device:
$ dd if=/dev/zero of=/root/scratch.img bs=1m count=64 && vnconfig -c -s labels /dev/vn0 /root/scratch.img

$ /root/poc_secsize /dev/vn0s0
[*] device:       /dev/vn0s0
[*] d_secsize:    0x00200000 (2097152 bytes, MAXPHYS=131072)
[*] b_bufsize:    131072 (MAXPHYS)
[*] secsize/bufsize ratio: 16.00x
[*] checksum dkcksum32(lp) = 0x0000 (want 0)
[*] issuing DIOCWDINFO32 ... (GENERIC: expect KKASSERT panic at subr_disklabel32.c:336)
[*] ioctl returned rc=-1
[!] errno=22 (Invalid argument) — no panic; either INVARIANTS-OFF (oversized I/O passed to driver) or an upstream guard rejected it.
PoC_EXIT=1

$ vm.sh status => up      (guest stayed up, NO panic)

=== Determinism check (3 consecutive runs on the patched kernel) ===
RUN 1: errno=22 (EINVAL) — guest up
RUN 2: errno=22 (EINVAL) — guest up
RUN 3: errno=22 (EINVAL) — guest up (fresh vn device)
grep -c panic boot.log => 0

=== VERDICT ===
BEFORE (baseline #0): PoC panics the kernel at subr_disklabel32.c:336 (KKASSERT d_secsize <= b_bufsize)
AFTER  (patched  #1): PoC returns EINVAL (the new guard at :340), guest stays up, zero panics
=> fix.diff CLOSES the bug.