== guest uname ==
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026    root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

== kldstat (after PoC setup) ==
Id Refs Address                Size Name
 1    8 0xffffffff80200000  1ad8538 kernel
 4    1 0xffffffff82600000    13000 ng_lmi.ko     (unpatched baseline; size 0x13000)
 5    2 0xffffffff82613000    3e000 netgraph.ko
 6    1 0xffffffff82651000    18000 ng_socket.ko

== cc version ==
cc (DragonFly) 8.3 [DragonFly] Release/2019-02-22

== relevant sysctls ==
(bug does not depend on sysctls)

== PoC path ==
ng_lmi node created via ngctl (root) -- PF_NETGRAPH control sockets are
root-only in DragonFly (caps_priv_check RESTRICTEDROOT at
sys/netgraph/socket/ng_socket.c:172). Realistic threat model is a remote
Frame Relay peer feeding a malformed LMI frame over a serial link into
an ng_lmi node configured by an admin; locally the same primitive is
reachable by any user given write access to a hook that feeds ng_lmi.

== Hardening status (audit guest) ==
INVARIANTS ON  (X86_64_GENERIC default)
SMAP/SMEP OFF  (CPU features 0x1783fbfd lack leaf-7 SMAP/SMEP bits)
KASLR     OFF  (vm.randomize_mmap=0)