=== guest uname (baseline kernel — decisive attack ran here) ===
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
    root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
kern.osreldate=600519

=== guest uname (fix-validation kernel) ===
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Sun Oct 11 21:52:44 UTC 2026
    root@dfbsd:/usr/obj/usr/src/sys/DF1215FIX  x86_64

=== compiler version (guest) ===
cc 8.3 [DragonFly] Release/2019-02-22 (Free Software Foundation, Inc.)

=== PCI devices present (QEMU) — re-verified 2026-10-11 ===
hostb0@pci0:0:0:0:   Intel 440FX - 82441FX PMC [Natoma]
isab1@pci0:0:1:0:    Intel 82371SB PIIX3 ISA [Natoma/Triton II]
atapci0@pci0:0:1:1:  Intel 82371SB PIIX3 IDE [Natoma/Triton II]
none0@pci0:0:1:3:    Intel 82371AB/EB/MB PIIX4 ACPI
vgapci0@pci0:0:2:0:  VGA display controller (0x11111234 - QEMU std)
virtio_pci0@pci0:0:3:0: Red Hat Virtio network device
virtio_pci1@pci0:0:4:0: Red Hat Virtio block device
NO Brooktree bt848/878 PCI capture device -> driver never attaches,
/dev/bktr0 never created (ls: No such file or directory — re-verified).

=== module state ===
/boot/kernel/bktr.ko     present, UNFIXED production (built Jun 29 from pristine source)
/boot/kernel/bktr_mem.ko present (dependency)
baseline rig load: kldstat shows kernel, ehci.ko, xhci.ko, bktrig.ko, bktr.ko, bktr_mem.ko
fixed-kernel rig load: bktr compiled into DF1215FIX kernel; bktrig_nodep.ko loaded
nm /boot/kernel/bktr.ko:    0000000000005190 T video_ioctl   (production, unfixed)
nm DF1215FIX kernel:        ffffffff80830790 T video_ioctl   (fixed, compiled in)

=== unpriv user used for the attack ===
uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)   # no operator/wheel

=== hardening state (baseline snapshot) ===
INVARIANTS compiled in (GENERIC); SMAP/SMEP/KASLR/KPTI: OFF (audit env)

=== rig (synthetic attach, PRODUCTION handler) ===
bktrig.ko: /dev/bktrig0 0666 -> video_ioctl() resolved from loaded bktr.ko
dmesg: bktrig: DF-1215 rig ready /dev/bktrig0 sc=0xfffff80118799f00
       (video_ioctl=0xffffffff82606190)