=== DF-0897 PoC on PATCHED kernel #1 (fix.diff applied) ===
Kernel: DragonFly 6.5-DEVELOPMENT #1: Tue Jul  7 05:05:35 UTC 2026
SHA256: a791dbfbb25dbe4df5a5b4f53991907b1bf629f531daea94ae9bad11c3e8308b

--- Run 1 ---
[*] sizeof(struct devfs_rule_ioctl) = 3112
[*] name starts at offset 1040, linkname at offset 2064
[*] strlen(name) will scan 2071 bytes before hitting NUL at struct end
[*] Sending DEVFS_RULE_ADD with non-NUL-terminated name...
[*] DEVFS_RULE_ADD returned -1 (errno=22: Invalid argument)
[!] ADD failed; cannot proceed to APPLY
RUN_EXIT=1
Guest status after run: UP (no panic, no crash)

--- Run 2 (determinism check) ---
[*] Sending DEVFS_RULE_ADD with non-NUL-terminated name...
[*] DEVFS_RULE_ADD returned -1 (errno=22: Invalid argument)
RUN2_EXIT=1
Guest status after run: UP

=== Before/After Contrast ===
BEFORE (#0 unpatched): DEVFS_RULE_ADD returns 0 (success), then
  DEVFS_RULE_APPLY triggers stack smash → Fatal trap 9 (GPF),
  frame pointer = 0x4141414141414141 (attacker-controlled 'A' bytes),
  crash at devfs_rule_checkname.isra.0+0x95: ret. Guest DOWN.

AFTER  (#1 patched):   DEVFS_RULE_ADD returns EINVAL (strnlen detects
  non-NUL-terminated name at PATH_MAX boundary). Rule NOT added.
  No APPLY triggered, no crash, guest stays UP. Fix closes the bug.