=== DF-0718 BASELINE: panic.c on BUGGY #0 kernel (orig smbfs.ko sha d854773e...) ===
command: ssh dfbsd '/home/maxx/panic'   (as root, smbfs loaded)
result:  process did NOT return (RUN_RC=124 timeout); guest died in DDB.

stdout (none — panic before printf returns):
  [+] socket 3: SO_RCVLOWAT set to 3 (VBLK) -> lands at vnode v_type offset
  [*] so_rcv.ssb_mbmax (~26KB, non-NULL) will be read as v_rdev
  [*] vn_todev() returns ssb_mbmax as garbage cdev_t
  [*] SMB_GETDEV(garbage)->si_drv1 will wild-deref -> PANIC
  [*] issuing mount(SMBFS) with args.dev = 3 ...
  (kernel panic — no further output; ssh died)

=== Determinism: reproduced on a FRESH vm.sh reset with-src boot ===
  Identical signature: fault virtual address = 0x70098; smb_dev2share+0x59.

Panic signature (from dfbsd-qemu/boot.log) — see panic.txt:
  Fatal trap 12: page fault while in kernel mode
  fault virtual address    = 0x70098
  Stopped at  smb_dev2share+0x59:   movq  0x98(%rax),%rax