== Phase 8 patched-kernel health check (post-install of #1 single-fix kernel) ==
kern.version (patched) = DragonFly 6.5-DEVELOPMENT #1: Sat Jul 18 02:40:00 UTC 2026
sha256 (kernel.stripped)= 7a3b1de7638f61e222b9755761d86a69d724905e787edf98dac07de18d970b0c

The single-fix kernel (both DF-1556 + DF-1557 patches applied, both compiled
into sys/dev/raid/mps/mps_config.c with -Werror and zero warnings) boots
cleanly and the guest is fully responsive.  Source confirmation that both
fixes are present in the booted /usr/src tree:

  $ grep -n 'DF-1556\|DF-1557' /usr/src/sys/dev/raid/mps/mps_config.c
  462:  /* DF-1557: PhysDiskMap is an untrusted U8 from firmware and indexes
  1129: /* DF-1556: bound the final copy by the caller's buffer capacity, not

NOTE on Phase 8 verdict — fix_status: not_testable (live trigger):
The live in-kernel before/after test cannot be performed because the guest
has no LSI SAS HBA: mps(4) is compiled into X86_64_GENERIC but never attaches,
so the vulnerable mps_wd_config_pages() -> mps_config_get_raid_volume_pg0()
code path is never executed at runtime on this guest.  The harnesses in this
folder are userspace reproductions of the exact kernel C logic; they
demonstrate the primitive but do not exercise the kernel and therefore do
not change between the #0 unpatched and #1 patched kernels.  What IS
validated here is: (a) the fix.diff applies cleanly with `patch -p1`, (b)
the patched mps_config.c compiles cleanly into both the kernel and the mps
module with -Werror and zero warnings, (c) the resulting kernel boots and is
healthy, and (d) the fix logic is correct by inspection (MIN() against the
caller's actual buffer capacity for DF-1556; explicit bounds check +
fault-logged goto-out for DF-1557).  This is the documented Phase 8
"not_testable — PoC can't run on this guest" case (no LSI HBA); the fix is
validated to apply + compile + boot, and traced to close the cited code path.