DF-0761 test environment (baseline #0 unpatched kernel)
=======================================================

Guest uname:
  DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

Compiler:
  cc 8.3 [DragonFly] Release/2019-02-22

Default sysctls (before run.sh touches them):
  net.filters_default_to_accept: 0
  kern.securelevel: -1

Module state:
  ipfw3 is NOT loaded by default; run.sh loads it after flipping
  net.filters_default_to_accept=1 so loading does not black-hole ssh.

Threat model:
  root@securelevel>=3 (the boundary securelevel 3 is meant to contain a
  compromised root).  This is a privileged-only policy/logic bypass — NOT
  memory corruption, NO unprivileged escalation chain.

SSH aliases used (via dfbsd-qemu/config):
  ssh -F dfbsd-qemu/config dfbsd       -> root
  ssh -F dfbsd-qemu/config dfbsd-maxx  -> maxx (uid 1001)