=== UNPATCHED kernel #0 — PoC: evil.udf (lb_size=0, packet_len=2048) ===
kern.version: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026

Command:
  vnconfig -c vn0 evil.udf
  mount -t udf -o rdonly /dev/vn0 /mnt/udf

Result: MOUNT PANICS (guest enters DDB — ssh dies, serial shows #DE trap)

From dfbsd-qemu/boot.log (serial console):
  vn0: MBR magic not found; assume a COMPATIBILITY_SLICE (s0)

  Fatal trap 18: integer divide fault while in kernel mode
  cpuid = 2; lapic id = 2
  instruction pointer        = 0x8:0xffffffff82600fc4
  stack pointer               = 0x10:0xfffff80118295340
  frame pointer               = 0x10:0xfffff801182956b0
  code segment                = base 0x0, limit 0xfffff, type 0x1b
                              = DPL 0, pres 1, long 1, def32 0, gran 1
  processor eflags            = interrupt enabled, resume, IOPL = 0
  current process             = 1019
  current thread              = pri 6
  kernel: type 18 trap, code=0

  CPU2 stopping CPUs: 0x0000003b
   stopped
  Stopped at      udf_mount.part.2+0x814: idivl   0x200(%r14),%eax
  db>

Root cause: udf_vfsops.c:306 assigns bsize=lvd->lb_size (=0 from disk) with no
validation; line 667 in udf_find_partmaps divides packet_len/bsize => #DE trap.