# DF-2215: dm_target_zero FREEBLKS memset (LATENT)

## Build & Run

### Setup (as root)
```
kldload dm
cc -O2 -o poc poc.c -lprop
```

### Run (as root — control dev is 0640 root:operator)
```
./poc
```

## Expected Output
The PoC creates a dm-zero device, then attempts `newfs` + `mount -o trim`.
The mount fails:
```
Device:/dev/mapper/df2215dev does not support the TRIM command
```

This proves the FREEBLKS path is unreachable: `dm_ops` lacks `D_CANFREE`,
so the dm device never claims TRIM support. Without `MNT_TRIM`,
`ffs_blkfree` never generates FREEBLKS bios, and `VOP_FREEBLKS` returns
early for dm devices.

The code-level bug IS real: `dm_target_zero_strategy` (dm_target_zero.c:43)
calls `memset(bp->b_data, ...)` unconditionally — if a FREEBLKS bio ever
reached this function, `bp->b_data` would be NULL → panic. But on this kernel,
FREEBLKS bios never reach a dm device. This is a latent / defense-in-depth
hardening gap. See `fix.diff` for the guard.