DragonFly 6.5-DEVELOPMENT #0 (master DEV build) — X86_64_GENERIC, INVARIANTS ON
uname: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  x86_64
cc:    cc 8.3 [DragonFly] Release/2019-02-22

KERNEL/DRIVER AVAILABILITY ON THIS GUEST:
  mpr (LSI MPT-Fusion 3 SAS): compiled INTO X86_64_GENERIC (kldstat -v -> "pci/mpr")
                              but NO LSI/Avago SAS3+ HBA is present in the QEMU guest
                              -> mpr_attach_user() never runs -> NO /dev/mpr0 device node
                              -> ls /dev/mpr* => "No such file or directory"
  mps (LSI MPT-Fusion 2 SAS): same — compiled in, no HBA, no /dev/mps0
  amdgpu (AMD GPU DC display stack): NOT compiled into X86_64_GENERIC; NOT a loadable
                              module on this guest; NO AMD GPU hardware in QEMU
  Only mass-storage PCI: Intel PIIX3 IDE, Virtio block device.

PERMISSION MODEL (relevant to mpr findings):
  mpr_attach_user() creates the device node as
      make_dev(..., UID_ROOT, GID_OPERATOR, 0640, "mpr%d", unit)
  mpr_open() returns 0 unconditionally — no further privilege check.
  mpr_ioctl() has NO priv_check()/suser() — gate is purely device-open.
  => reachable by root OR any operator-group user, on a host with an mpr HBA.
  => NOT reachable on this guest (no HBA -> no node).

This guest therefore CANNOT execute any of the 5 PoCs end-to-end.  The code
paths are traced line-by-line in VERDICT.md and the fix.diffs were validated
to apply + compile (mpr trio via a full single-fix nativekernel build).