DF-2504 baseline run (BEFORE the fix, stock kernel
"DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026")

Session 1 — control, root:
  $ ./poc_setblocksize /dev/acd0 2352
  == DF-2504 PoC ==
  open(/dev/acd0, O_RDONLY) = fd 3
  control: CDRIOCSETBLOCKSIZE(2352) ... ok
  control: CDRIOCGETBLOCKSIZE -> 2352

Session 2 — unprivileged operator-group user (maxx, uid 1001, groups
1001(maxx),5(operator)) — open gate REFUSES (see unpriv_open_test.log):
  $ ~/poc /dev/acd0 2352
  == DF-2504 PoC ==
  open(/dev/acd0, O_RDONLY): Operation not permitted

Session 3 — the fatal run, root (real /dev/acd0 = empty QEMU DVD-ROM,
O_RDONLY, single ioctl, NO disc required):
  $ /root/dfrig4/poc_setblocksize /dev/acd0
  == DF-2504 PoC ==
  open(/dev/acd0, O_RDONLY) = fd 3
  firing CDRIOCSETBLOCKSIZE(0): atapi-cd.c:724 stores 0 into
      cdp->block_size, :951 rounddown(iomax=65534, 0) divides --
      FATAL TRAP expected
  (ssh session dies here -- kernel panics)

Serial console (dfbsd-qemu/boot.log -> panic.txt):
  Fatal trap 18: integer divide fault while in kernel mode
  cpuid = 5; lapic id = 5
  instruction pointer = 0x8:0xffffffff8033d269
  current process = 1754
  kernel: type 18 trap, code=0
  Stopped at      acd_set_ioparm+0x69:    divl    %ecx,%eax
  db>

The trap is EXACTLY the rounddown(cdp->iomax, cdp->block_size)
division at sys/dev/disk/nata/atapi-cd.c:951, reached from
acd_ioctl's CDRIOCSETBLOCKSIZE case (atapi-cd.c:723-726).

Session 4 — PATCHED kernel (#1: Thu Oct 15 23:37:29 UTC 2026):
  $ /root/dfrig4/poc_setblocksize /dev/acd0 2352
  control: CDRIOCSETBLOCKSIZE(2352) ... ok
  control: CDRIOCGETBLOCKSIZE -> 2352
  $ /root/dfrig4/poc_setblocksize /dev/acd0
  firing CDRIOCSETBLOCKSIZE(0): ... FATAL TRAP expected
  ioctl error: Invalid argument
  SURVIVED-PATCHED
  (guest stays up; see fix_validation notes in VERDICT.md)