== uname == DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #2: Mon Oct 19 11:32:07 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/DFX2423 x86_64 == ident == DragonFly 6.5-DEVELOPMENT #2: Mon Oct 19 11:32:07 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/DFX2423 == cc == cc 8.3 [DragonFly] Release/2019-02-22 == ahci in kernel config == 56:options INVARIANTS 65:device ahci == kldstat == Id Refs Address Size Name 1 5 0xffffffff80200000 1adb980 kernel 2 1 0xffffffff81cdc000 7c288 ehci.ko 3 1 0xffffffff81d59000 8c778 xhci.ko == sc_ncmds (AHCI cmd slots) == == xpt dev perms == crw------- 1 root operator 30, 0x00000000 Oct 19 11:36 /dev/pass0 crw------- 1 root operator 28, 0x00000000 Oct 19 11:36 /dev/xpt0 == TU hashes == 8a42cfdb25441c8c619daced4f029c8fe60dddc244a8179194413d05163a987f == harness == 8c3f8d929393b117274cfbb5762fd1511ae38968ac7e3ab72ddd0724f4aad38e == page-0 mmap policy (privesc close, guest-verified 2026-10-19) == mmap(FIXED,0) -> 0x0 errno=0 (page mapped) page0 writable, readback=4141414141414141 => DragonFly allows user MAP_FIXED page 0; relevant only if the deref ever ran in a user vmm context (none does today: /dev/xpt0 /dev/passN are 0600 root:operator; async-notify path runs in kernel threads).