DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
(baseline kernel, md5 4625046e8061b34e1758d291bc6cad18 -- identical build to the
 DF-1326 baseline; mps compiled into X86_64_GENERIC, sys/config/X86_64_GENERIC:92)

PASS-3 (real-handler rig) environment:
  patched kernel (fix validation): 6.5-DEVELOPMENT #1 Sun Oct 11 23:24:14 UTC 2026,
      md5 06407b51b4faf526c26e1c25c198d2fd (single-fix nativekernel, fix.diff 3/3 hunks)
  symbols (baseline kernel, from nm /boot/kernel/kernel):
      mps_ioctl_devsw   t 0xffffffff805b16d0   (patched kernel: 0xffffffff805b16f0)
      mps_user_pass_thru t 0xffffffff805b0be0  (both kernels)
  frame layout of mps_user_pass_thru (proven by objdump, baseline):
      copyin site  +0x7b  (0xffffffff805b0c5b): lea -0x3c(%rbp),%rsi ; call copyin
      epilogue     +0x62d (0xffffffff805b120d): lea -0x28(%rbp),%rsp ;
                    pop rbx,r12,r13,r14,r15,rbp ; ret (+0x63e = the retq)
      -> saved RIP at &tmphdr + 0x44   (5 pushes + sub 0x28; tmphdr rbp-0x3c)
  mps_softc offsets touched by the compiled prologue (proven by disasm):
      +0x000 mps_dev, +0x010 mps_flags(MPS_FLAGS_BUSY=4), +0x014 mps_debug,
      +0x0d0 command free-list head, +0x148 facts POINTER (IOCRequestFrameSize
      U16 @ facts+0x24; fabricated 32 -> post-hoc bound 128, same as mpr twin),
      +0x190 mps_lock
  /dev/mps*: absent (no LSI Fusion-MPT HBA on this QEMU guest)
  mps driver: compiled into X86_64_GENERIC (attaches when such HW exists)
  operator user: uid=2(operator) gid=5(operator), shell /bin/sh (pw usermod)
  rig node: /dev/df1359rig 0640 root:operator (make_dev, same boundary as
      mps_attach_user() mps_user.c:188)
  kernel has no stack canary: kmod/kernel CFLAGS show -fno-stack-protector
  cc 8.3 [DragonFly]