# DF-1044 — vkernel64 busdma bounce-waiter panic / `add_map_callback` transposition

## Build & Run (static verification path)

This finding is a **vkernel64-only** code path. The DragonFlyBSD master DEV
audit guest runs a real `X86_64_GENERIC` kernel (NOT a vkernel), and the
default `VKERNEL64` config loads no `bus_dma`-using driver, so the bug is
verified by **source inspection** against the audited `sys/` tree (the
finding's explicitly blessed alternate path) plus a **single-file compile
check** of `busdma_machdep.c` with and without the fix against the vkernel64
kernel build env.

```
./verify.sh        # prints the source-level evidence (cited lines) for both defects
./build_fix.sh     # compiles the patched busdma_machdep.c with -Werror in the vkernel64 env
                   # (requires in-guest /usr/src + warm VKERNEL64 obj; see env)
```

Expected:
- `verify.sh` shows `panic("%s uncoded", __func__)` at line 1215 and
  `add_map_callback(map)` (should be `wait_map`) at line 1120.
- `build_fix.sh` prints `BUILD_DONE rc=0` and produces `busdma_machdep.o`.

Dynamic trigger (NOT run): the PoC skeleton is a loadable kld module that
would need a running vkernel to load into. See README.md and VERDICT.md.