Guest environment for DF-2073 verification (HW-gated, source-only):

uname: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0/#1
  #0 = Thu Jul  2 06:02:54 UTC 2026  (unpatched baseline, with-src snapshot)
  #1 = Sat Jul 25 11:53:22 UTC 2026   (combined-fix kernel, both DF-2073+DF-2074 applied)
cc:   cc 8.3 [DragonFly] Release/2019-02-22
kernel config: X86_64_GENERIC (options INVARIANTS, NO options AH_ASSERT)

Hardware gate (source-only confirmation):
  $ pciconf -l | grep -iE "ath|atheros|mlx|mylex"
  NO_HW_MATCH
  => No AR5212-class ath(4) NIC present. ar5212ResetKeyCacheEntry cannot be
     reached at runtime on this guest. Verification is by source trace only.

Source-tree confirmation (read-only sys/):
  sys/dev/netif/ath/ath_hal/ar5212/ar5212_keycache.c:86-97
    - micentry = entry+64; HALASSERT(micentry<size) [INERT]; OS_REG_WRITE past aperture
  sys/dev/netif/ath/ath_hal/ar5212/ar5212_keycache.c:165-190
    - SetKeyCacheEntry has genuine runtime guard at :185 (but only when MIC enabled)
  sys/dev/netif/ath/ath_hal/ah_internal.h:665-676
    - HALASSERT expands to NOTHING unless AH_ASSERT defined
  sys/config/LINT64:1104  options AH_ASSERT   (LINT64-only)
  sys/config/X86_64_GENERIC  (no AH_ASSERT)    => HALASSERT inert on GENERIC
  sys/dev/netif/ath/ath_hal/ar5212/ar5212_attach.c:710,868-870
    - halKeyCacheSize default = AR_KEYTABLE_SIZE = 128
  sys/dev/netif/ath/ath_hal/ar5212/ar5212reg.h:334-335
    - AR_KEYTABLE(_n) = 0x8800 + _n*32 ; aperture end = 0x8800+128*32 = 0x9800
    - entry=127 => micentry=191 => AR_KEYTABLE_KEY0(191)=0x9FE0 (past 0x9800 aperture)

Fix validation:
  fix.diff applied to /usr/src; combined (DF-2073+DF-2074) nativekernel build:
    rc=0, -Werror clean (no error/warning), kernel.stripped+kernel.debug produced
  Booted as kern.version #1 (Sat Jul 25 11:53:22 UTC 2026); guest healthy.
  Runtime before/after NOT possible (HW absent) => not_testable at runtime;
  build-validated + source-traced.