=== DF-0773 patched-kernel run (single-fix kernel #1) ===
Guest: DragonFly 6.5-DEVELOPMENT #1: Thu Jul  9 21:10:29 UTC 2026
       (single-fix kernel: with-src baseline + fix.diff applied)
Run:   ./dfbsd-qemu/vm.sh run_root 'cd /root/poc0773 && timeout 25 ./trigger'
Date:  2026-07-09

[+] getfh("/dev/null") OK
[+] raw fhandle (28 bytes):
  0000: ff ff 74 42 08 00 00 00 10 00 00 00 c9 0f 50 6a
  0010: af 00 00 00 00 00 00 00 00 00 00 00
[+] /dev/null is on f_type=devfs f_fsid=[0x4274ffff,0x8]
[+] original devfs_fid: len=16 pad=0 gen=1783631817 ino=175
[+] mutated  devfs_fid: len=16 pad=0 gen=1783631817 ino=16045690984503098046
[*] calling fhstat() with bogus devfs fid_ino -> expect panic...
[-] fhstat returned rc=-1 errno=2 (No such file or directory) — NOT vulnerable?
TRIGGER_RC=1

(2nd run for determinism — identical ENOENT, no panic, guest stays up)

=== Conclusion ===

BEFORE (unpatched #0 kernel): identical PoC -> kernel panic
  Fatal trap 12 page fault, fault VA=0x0, lockmgr_exclusive+0x5d: orl (%r14),%esi
  guest died, ssh torn down, DDB prompt.

AFTER  (single-fix #1 kernel): identical PoC -> fhstat returns ENOENT
  (devfs_vfs_fhtovp sees vp==NULL from devfs_inode_to_vnode and returns
  ENOENT at line 217), no panic, guest fully responsive.

fix_status: fixed