DF-0767 — unprivileged-trigger run log (UNPATCHED baseline #0 kernel)
======================================================================

Guest kernel (unpatched audit-source baseline):
  DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026

Setup (admin pre-condition): malicious NFSv3 server on 127.0.0.1, mounted
at /mnt:
    $ mount_nfs -3 -T -o tcp,nfsv3 127.0.0.1:/export /mnt   (MOUNT_RC=0)
    $ mount | grep mnt
    127.0.0.1:/export on /mnt (nfs)

Unprivileged trigger (as maxx, uid 1001) — ssh -c, 20s timeout:
    $ id
    uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)
    $ mkdir /mnt/df0767_pwn
    <<ssh connection dies here (kernel panic)>>
    ssh_rc=124 (timeout — guest no longer answers)

Guest status after trigger: DOWN (panicked into DDB)

Panic signature captured from dfbsd-qemu/boot.log (serial console):
    Fatal trap 9: general protection fault while in kernel mode
    cpuid = 0; lapic id = 0
    instruction pointer = 0x8:0xffffffff8080f5d8
    stack pointer            = 0x10:0xfffff801182df428
    frame pointer            = 0x10:0xfffff801182df5e8
    code segment = base 0x0, limit 0xffff, type 0x1b
                 = DPL 0, pres 1, long 1, def32 0, gran 1
    processor eflags = interrupt enabled, resume, IOPL = 0
    current process = 870
    kernel: type 9 trap, code=0
    CPU0 stopping CPUs: 0x0000003e
     stopped
    Stopped at      nfs_mkdir+0x328:        cmpl    $0x2,0xe8(%rdi)
    db>

== interpretation ==
nfs_mkdir+0x328 corresponds to nfs_vnops.c:2355 `if (newvp->v_type != VDIR)`.
`newvp` was just produced by `newvp = NFSTOV(np)` (line 2354), where `np` is
the uninitialized stack-local returned from nfs_lookitup()'s NFS_CMPFH branch
(line 3087) via the trailing `*npp = np` (line 3127).  rdi == wild `newvp`;
`cmpl $0x2,0xe8(%rdi)` reads struct vnode.v_type at offset 0xe8 and compares
to VDIR(=2).  GPF (trap 9) fires because the wild `newvp` (derived from
garbage `np->n_vnode`) is a non-canonical x86-64 address.