$ ssh -F dfbsd-qemu/config dfbsd-maxx 'cd poc/DF-1227 && cc -O -I/usr/src/sys -o mpr_nvme_prp_overflow mpr_nvme_prp_overflow.c 2>&1; echo "BUILD_EXIT=$?"'
BUILD_EXIT=0

$ ssh -F dfbsd-qemu/config dfbsd-maxx 'cd poc/DF-1227 && ./mpr_nvme_prp_overflow 2>&1; echo "RUN_EXIT=$?"'
/dev/mpr0: open failed: No such file or directory
(no mpr(4) controller attached on this guest => node absent; or caller lacks rw perms)
RUN_EXIT=2

# Reachability verdict: no mpr(4) controller on the guest => no /dev/mprN
# cdev => MPTIOCTL_PASS_THRU (the vulnerable ioctl entry) is unreachable here,
# regardless of privilege. The PoC would trigger the mpr_build_nvme_prp heap
# overflow on any host with an mpr controller + an rw-openable /dev/mprN.