=== DF-0673 attempted live trigger (6.5-DEVELOPMENT #0, smbfs.ko loaded) ===
[server] listening on 127.0.0.1:139
[server] accepted conn 0
[server] sent positive session response
[server] got SMB negotiate (104 bytes)
[server] sent negotiate response
[server] sent msg hdr claiming 4000, delivered 50 bytes
[server] closed (RST)
... mount_smbfs hangs in D1 (uninterruptible) waiting on smbiod ...
... smbiod blocks waiting on a fully-conforming negotiate response ...

ps -aux:
root 922 mount_smbfs ... D1
root 923 (smbiod0)      D5

=== Conclusion ===
The minimal fake server doesn't speak enough SMB1 to advance the kernel
client past negotiation into the post-negotiate nbssn_recv call where the
leak lives. The bug is unambiguous in source; a live PoC would require a
fully-conforming NBSS+SMB1 negotiate response. See VERDICT.md for the
source-level trace.