DF-0767 — unprivileged-trigger run log (PATCHED single-fix kernel, decisive run #1)
================================================================================

Guest kernel (patched, Fix B applied):
  DragonFly 6.5-DEVELOPMENT #1: Wed Jul  8 08:25:27 UTC 2026
  /boot/kernel/kernel sha256 = b663c4518622ac001198111c94b4ea3a85972521cffb3a9097eae52a9c7bf5e2

Setup (admin pre-condition, like "admin mounted an NFS share"):
  malicious NFSv3 server (nfs_mal_server) running on 127.0.0.1 (rpcbind :111,
  MOUNT+NFS :2049); mounted at /mnt:
    $ mount_nfs -3 -T -o tcp,nfsv3 127.0.0.1:/export /mnt
    $ mount | grep mnt
    127.0.0.1:/export on /mnt (nfs)

Unprivileged trigger (as maxx, uid 1001):
    $ id
    uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)
    $ mkdir /mnt/df0767_pwn
    mkdir: /mnt/df0767_pwn: File exists
    $ echo $?
    1
    $ ls -la /mnt/
    total 0
    $ echo ALIVE_OK
    ALIVE_OK

Guest status after trigger: up (NO panic, NO crash)

boot.log panic check: (empty — no fatal trap / panic on the patched kernel)

== Determinism ==
Run #2 (fresh server + re-mount, two mkdirs):
    $ mkdir /mnt/df0767_pwn_2   -> mkdir: File exists (rc=1)
    $ mkdir /mnt/df0767_pwn_3   -> mkdir: File exists (rc=1)
    $ echo ALIVE2
    ALIVE2
Guest status: up. boot.log: no panic.

== Conclusion ==
On the patched (Fix B) kernel, the malicious-server trigger that panic'd the
unpatched kernel (nfs_mkdir+0x328 wild-pointer deref) now returns EEXIST
gracefully and the guest stays up.  Fix validated.