DF-0624 verification environment (DragonFlyBSD master DEV guest, QEMU/KVM)
================================================================================
uname -a (unpatched baseline, #0):
  DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  x86_64
kern.version:
  DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
cc: cc 8.3 [DragonFly] Release/2019-02-22
kernel config: X86_64_GENERIC (options INVARIANTS ON)

smbfs / netsmb runtime state:
  - smb client stack is a KLD: /boot/kernel/smb.ko (116552 B) + /boot/kernel/smbfs.ko
  - NOT loaded by default; `kldload smb` loads it for the test.
  - mount_smbfs + smbutil present in guest (/sbin/mount_smbfs, /usr/bin/smbutil).
  - default SMB port 139 (SMB_TCP_PORT, sys/netproto/smb/smb.h); server also binds 445.

Network (QEMU user-mode networking):
  - guest vtnet0 = 10.0.2.15; host gateway = 10.0.2.2.
  - guest CAN reach host: confirmed (guest -> 10.0.2.2:445 TCP reachable;
    "Connection refused" with no server, full handshake with server).
  - malicious server runs on the HOST (0.0.0.0:139 + :445); victim mounts
    //guest@10.0.2.2/share.

Reproduction tooling:
  - malicious_smb_server.py: pure-Python stdlib SMB1 server (no impacket needed).
  - run_live.sh: host server (bg, fds detached) + guest client, kills server on exit.

Trigger:
  - victim: kldload smb; mount_smbfs -N -I 10.0.2.2 //guest@10.0.2.2/share; ls
  - attacker: TRANS2 response with ParameterCount > actual body -> bug.