DF-2504 unprivileged-reachability probe (BEFORE any kernel change,
stock kernel #0 Thu Jul 2 06:02:54 UTC 2026).

The finding claims "Any operator-group user, single ioctl,
deterministic panic, O_RDONLY sufficient". Probe of the open gate on
the live guest (maxx, uid 1001, added to group operator first):

  $ pw groupmod operator -m maxx        (as root)
  $ id
  uid=1001(maxx) gid=1001(maxx) groups=1001(maxx),5(operator)
  $ ls -l /dev/acd0 /dev/cd0
  crw-r----- 1 root operator 24, 0x1e110007 Oct 15 23:04 /dev/acd0
  crw-r----- 1 root operator 29, 0x1e110007 Oct 15 23:04 /dev/cd0

  $ /tmp/t   (open() probes as maxx)
  /dev/acd0 O_RDONLY: Operation not permitted   (EPERM)
  /dev/acd0 O_WRONLY: Permission denied         (EACCES = file mode)
  /dev/cd0  O_RDONLY: Operation not permitted   (EPERM)
  /dev/cd0  O_WRONLY: Permission denied         (EACCES)
  /dev/serno/QM00003: Operation not permitted   (EPERM, raw system disk)
  /dev/pass0: Permission denied                  (EACCES, non-disk)

EPERM (not EACCES) on O_RDONLY of every raw DISK device for
non-root: the disk layer's RESTRICTEDROOT gate:

  sys/kern/subr_disk.c:1070-1073 (diskopen):
	/*
	 * Disallow access to disk volumes if RESTRICTEDROOT
	 */
	if (caps_priv_check_self(SYSCAP_RESTRICTEDROOT))
		return (EPERM);

Both /dev/cd0 (disk1_ops via make_dev_covering, subr_disk.c:719-732)
and the raw /dev/acd0 path on this build are behind the gate (same
EPERM as /dev/serno/QM00003).  An operator-group user therefore
CANNOT reach acd_ioctl at all on current master; CDRIOCSETBLOCKSIZE
is only reachable by root / SYSCAP_RESTRICTEDROOT principals.

=> The divide-by-zero itself is REAL and reproduces as root
   (panic.txt: Fatal trap 18 at acd_set_ioparm+0x69: divl), but the
   finding's unprivileged-operator threat model is REFUTED at the
   device-open gate on this tree (gate verified identical in the
   guest's /usr/src: md5 subr_disk.c 2bd93facb700327a52d3fbaf20472019
   == audit tree).