Guest: DragonFly 6.5-DEVELOPMENT #0 (unpatched baseline)
Kernel:  DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
         root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
CC:      cc 8.3 [DragonFly] Release/2019-02-22

sysctls:
  vfs.usermount = 0                    (root-only mounts; image setup needs root)
  security.unprivileged_read_msgbuf = 1

Source:  /usr/src (full audit commit) + /usr/obj/usr/src/sys/X86_64_GENERIC warm obj
Root fs: vbd0s1d on / (hammer2, local)  -- HAMMER2 root, so any fd on '/' routes
         ioctls through hammer2_vop_ioctl.  Test mount /mnt/h2t is also hammer2.

Test image:  /root/t/h2.img   8.0 GB sparse, mounted at /mnt/h2t (read-only
             after corruption step).  Backed by vn(4) on /dev/vn0.

HAMMER2 tools present:  /sbin/newfs_hammer2, /sbin/hammer2, /sbin/mount_hammer2,
                        /usr/sbin/vnconfig