DF-1326 pass-3 rig build + fix build (guest, root). Unedited decisive lines.

--- 1. rig KLD (dispatches the REAL production handler) --------------------
$ cd /root/rig && make SYSDIR=/usr/src/sys MACHINE=x86_64 MACHINE_ARCH=x86_64
cc  -O2 -pipe   -D_KERNEL -Wall ... -Werror -DKLD_MODULE -nostdinc ... -fno-stack-protector ... -c df1326rig.c
(rc=0, no warnings; note -fno-stack-protector in the kernel's kmod CFLAGS)

$ cc -O -Wall -o trigger df1326rig_trigger.c
(no warnings, rc=0)

$ kldload ./df1326rig.ko
df1326rig: loaded; fake sc=0xfffff8008fa6fc00; /dev/df1326rig 0640 root:operator; gd_curthread@+8 td_proc@+168 p_ucred@+16 cr_uid@+64

$ ADDR=$(nm /boot/kernel/kernel | awk '/ t mpr_ioctl_devsw$/{print $1}')
$ echo $ADDR
ffffffff80598ab0                      <- baseline kernel #0 (md5 4625046e8061b34e1758d291bc6cad18)
$ sysctl -w kern.df1326rig_target=0xffffffff80598ab0
kern.df1326rig_target: 0 -> 18446744071567936176

--- 2. fix.diff applied to the in-guest source tree -------------------------
$ cd /usr/src && patch -p1 < /root/fix.diff
Patching file sys/dev/raid/mpr/mpr_user.c using Plan A...
Hunk #1 succeeded at 796.
Hunk #2 succeeded at 832.
Hunk #3 succeeded at 900.
done

--- 3. single-fix nativekernel build + install ------------------------------
$ cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC
...
--------------------------------------------------------------
>>> Kernel build for X86_64_GENERIC completed on Sun Oct 11 22:48:42 UTC 2026
--------------------------------------------------------------

$ cd /usr/src && make installkernel KERNCONF=X86_64_GENERIC
...
--------------------------------------------------------------
>>> Kernel install for X86_64_GENERIC completed on Sun Oct 11 22:54:05 UTC 2026
--------------------------------------------------------------
INSTALL_RC=0

Patched kernel boots (kernel #1, Sun Oct 11 22:45:42 UTC 2026,
md5 76ac5c67dfb83da3ed172fb944c17d27); nm shows the (unchanged) 16-byte
prologue of mpr_ioctl_devsw at its new address ffffffff80598ae0:

ffffffff80598ae0: 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 81 ec ...
(verified identical to baseline -> the rig's prologue check still
dispatches, now into the PATCHED production code)