DF-2255 / DF-2256 verification environment
==========================================
Date: 2026-10-17 (all times UTC)

Guest (QEMU/KVM, dfbsd-qemu/vm.sh):
  DragonFly dfbsd 6.5-DEVELOPMENT #9: Sat Oct 17 17:54:41 UTC 2026
      root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
  kern.osreldate=600519, hw.ncpu=6, hw.model: QEMU Virtual CPU version 2.5+
  root fs: hammer2 on vbd0s1d, /boot ufs
  cc 8.3 [DragonFly] Release/2019-02-22
  stock kernel flags observed in build logs: -O2 -std=gnu11 -ffreestanding
      -fno-stack-protector -fno-omit-frame-pointer -mcmodel=kernel
      -mno-red-zone -mindirect-branch=thunk-inline -Werror ...

Kernel / boot mapping (serial console banners in dfbsd-qemu/boot.log):
  #0  Thu Jul  2 06:02:54 UTC 2026   stock with-src snapshot kernel
  #2  Sat Oct 17 17:18:53            rig integrated (build6), baseline code
  #3  Sat Oct 17 17:33:15            harness fixes (build8)  - baseline code
  #4  Sat Oct 17 17:36:54            build9  - baseline code
  #5  Sat Oct 17 17:40:12            build10 - baseline code (selftest+uninit+otp2k)
  #6  Sat Oct 17 17:43:48            build11 - baseline code, FINAL baseline battery
  #7  Sat Oct 17 17:47:03            fix2255 applied (fix1_build)
  #8  Sat Oct 17 17:51:52            fix2255 + offset-fallback harness (fix1b_build)
  #9  Sat Oct 17 17:54:41            fix2255 + fix2256 (fix2_build), final counters

Verification target (guest /usr/src == audit repo tree, sha256 verified):
  sys/contrib/dev/ath/ath_hal/ar9300/ar9300_eeprom.c
      baseline  75771111c80e7ebc9f71857efec0e3a861b4a564f2417a17e747469fc4f2f77b
      +fix2255  d348bf370a68710601a027b691a848014b2243ae36fa251c3405778cf9456734
      +fix2256  952817c63489c99f44f665c1fddaaebfdd80117effd33eb0eba271491e88d8f8
  sys/contrib/dev/ath/ath_hal/ar9300/ar9300eep.h
      ea73b386800c492640914b55386cf6f2f696b8964c97658b9357e5404aa965df

Rig:
  kern.df2255.rig sysctl (kernel-compiled, sys/conf.files: kern/df2255_harness.c standard)
  harness sha256 53682c234e17482afc91927d7d896297b2f5080371d0d22298f237e8dfcec887
  selftest: kstack 16384 bytes, sentinel fidelity 8192/8192, word[0] at window+6080

Upstream comparison:
  FreeBSD head sys/contrib/dev/ath/ath_hal/ar9300/ar9300_eeprom.c
  fetched 2026-10-17 from cgit.freebsd.org
  sha256 ae1c326d8141201c2a1c7d2a27ebc306d5adc57b73134404d8d2e84c6dcc5b00
  still contains: #ifdef DONTUSE guard (line 3971), (void) read pattern
  (lines 3759/3959/3979) - both bugs present upstream

Measured facts:
  sizeof(ar9300_eeprom_t) = 1088 (packed, guest cc against real header)
  MOUTPUT=2048 MSTATE=100 compression_header_length=4
  compression_checksum_length=2 AR9300_EEPROM_SIZE=16384

Guest state at end: reverted to clean-source snapshot (vm.sh reset with-src);
guest_dirty=0. No panic occurred during any trigger run.