== DF-2446 patched dm.ko validation run ==
(kernel image stays at #0 baseline; only /boot/kernel/dm.ko replaced with
 the fix-applied rebuild: sha256 358587fc73cde9b697627e8f18e4aa2a36b94dd24ef375480c7c8fd213e2c47f)

[*] kldload dm (root)...
Device Mapper version 4.16.0 loaded
dm_target_error: Successfully initialized
dm_target_zero: Successfully initialized
[*] running PoC...
[*] create 'df2446dev': prop_dictionary_send_ioctl rv=0 (ok)
[*] sending message ioctl WITHOUT 'message' key...
[*] expect: kernel panic / INVARIANTS trap in kfree of uninitialized stack ptr
[!] message ioctl returned rv=22 (Invalid argument) -- kernel survived
RUN_EXIT=0
RUN_SH_EXIT=0

== second clean run (determinism check) ==
[*] create 'df2446dev': prop_dictionary_send_ioctl rv=0 (ok)
[*] sending message ioctl WITHOUT 'message' key...
[!] message ioctl returned rv=22 (Invalid argument) -- kernel survived
RUN_EXIT=0

== boot.log after patched run (NO panic) ==
Device Mapper version 4.16.0 loaded
dm_target_error: Successfully initialized
dm_target_zero: Successfully initialized
(empty of any fatal trap / panic / page fault)

== guest status after both runs ==
up

== verdict ==
The fix converts the uninitialized-pointer free into a clean EINVAL return
(EINVAL == 22) when the "message" key is absent from the dictionary. The
guest stays up. Bug is GONE on the patched dm.ko.