### Patched kernel: kern.version
DragonFly 6.5-DEVELOPMENT #1: Sat Aug  8 16:25:24 UTC 2026

### AFTER fix — oversized pref_len cases (expect E2BIG=errno 7, no alloc)
--- df_poc 0x40000000 ---
[*] small user ptr (0x7fffffdfd860, 64B); pref_len=0x40000000
[*] issuing UDEVPROP ioctl...
[+] ioctl returned -1, errno=7 (Argument list too long)
RC=1
--- df_poc 0x18000000 384 ---
[*] mapped 384 MiB at 0x800a00000; pref_len=0x18000000
[*] issuing UDEVPROP ioctl...
[+] ioctl returned -1, errno=7 (Argument list too long)
RC=1
--- df_poc 0xffffffffffffffff ---
[*] small user ptr (0x7fffffdfd940, 64B); pref_len=0xffffffffffffffff
[*] issuing UDEVPROP ioctl...
[+] ioctl returned -1, errno=7 (Argument list too long)
RC=1

### AFTER fix — benign 64-byte (legit path, expect EIO bad-XML, unchanged)
[*] small user ptr (0x7fffffdfd800, 64B); pref_len=0x40
[*] issuing UDEVPROP ioctl...
[+] ioctl returned -1, errno=5 (Input/output error)
RC=1