Guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
       x86_64, KVM 6 vCPU / 4 GB
       root shell via ssh dfbsd, maxx uid 1001 via ssh dfbsd-maxx

Kernel (unpatched baseline):
  DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC

Kernel (single-fix patched):
  DragonFly 6.5-DEVELOPMENT #1: Sat Jul 11 22:11:06 UTC 2026
  kernel sha256: b1817bbdf2cd380647cb77d6a28f5bec942c83356a1865aedc6420e7ee5fcf98
  udf.ko  sha256: 3dceb425cfce3f328dec84ee13e2325ec29d8c9828c6b79ac732fcbf7b277b70

UDF: loadable module (kldload udf); not compiled into GENERIC kernel
     udf.ko at /boot/kernel/udf.ko

Slab allocator:
  ZALLOC_ZONE_LIMIT = 16384 (allocs <= 16KB slab-managed)
  ZALLOC_MIN_ZONE_SIZE = 32KB, ZALLOC_MAX_ZONE_SIZE = 128KB
  PoC uses st_size=32768 → kmem page-zone (dedicated pages, unmapped neighbors)

Preconditions for exploitation:
  - root mounts attacker-controlled UDF image (vnconfig + mount -t udf)
  - OR vfs.usermount=1 + root-created image owned by unprivileged user
  - UDF module must be loadable (default in DragonFly)