=== DF-2227 fix_run.log — PATCHED (#1 single-fix kernel) validation ===
guest: DragonFly 6.5-DEVELOPMENT #1: Sat Aug  8 16:51:23 UTC 2026
       sha256(/boot/kernel/kernel) = 350f027415058ca3bf4331a8a16e31ecfa3cc4b218bc9ec5b29cd4c813766d94
fix:   while (!_PROP_EOF(*cp) && *cp != '"') cp++;   (was: while (*cp != '"') cp++;)
cmd:   /tmp/oob2227 60000   (SAME as baseline panic trigger)

run 1: [!] ioctl rc=-1 errno=5 (Input/output error) -- no panic, guest UP
run 2: [!] ioctl rc=-1 errno=5 (Input/output error) -- no panic, guest UP
run 3: [!] ioctl rc=-1 errno=5 (Input/output error) -- no panic, guest UP
small (pref_len=17): [!] ioctl rc=-1 errno=5 (Input/output error) -- no panic, guest UP

After all 4 runs: guest UP, 0 new "Fatal trap" in boot.log.
The fix's per-iteration _PROP_EOF(*cp) check stops the scan at the buf[pref_len]
NUL sentinel; the unterminated quote is then correctly detected as a parse error
(prop_object.c:486 _PROP_EOF check fires -> return false -> NULL -> EIO).
No OOB read, no panic. Legit-XML path (well-formed plist) still parses normally.