# DF-2450: dm_pdev NULL-deref via non-block-device backing path

## Build & Run

### Setup (as root)
```
kldload dm
cc -O2 -o poc poc.c -lprop
```

### Trigger (as root — control dev is 0640 root:operator)
```
./poc
```

## Expected Output (unpatched #0 kernel)
Kernel panic:
```
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xa8
Stopped at dev_dioctl+0xc: movq 0xa8(%rdi),%rax
```
The `reload` ioctl never returns; guest dies.

## Expected Output (fixed dm.ko)
```
[!] reload rv=2 (No such file or directory) -- kernel survived
```
Clean ENOENT; guest stays up.

## Mechanism
Reloading a `linear` table with a **regular file** as the backing path causes
`dm_pdev_insert` to `vn_open` the file (succeeds), then call
`dev_dioctl(vnode->v_rdev=NULL, DIOCGPART)` — NULL v_rdev deref.

The finding said "path does NOT resolve (e.g. /dev/nonexistent)"; that case
is handled cleanly (dm_dk_lookup fails, returns NULL, linear returns ENOENT).
The actual trigger is a path that resolves to a non-block-device vnode.