DF-2584 canonical run — STOCK kernel, UNPRIVILEGED trigger
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 (X86_64_GENERIC, INVARIANTS)
Image: h2c60.img (60-deep single-child INDIRECT chain under world-writable /f)

# root prepares the mount (fresh boot after vm.sh reset with-src):
$ mkdir -p /mnt/h2; vnconfig -c -S -T vn0 /root/h2c60.img && \
  mount -t hammer2 /dev/vn0@TESTFS /mnt/h2
-rw-rw-rw-  1 root  wheel  32768 Oct 14 09:14 /mnt/h2/f
ROOT-MOUNT-OK

# unprivileged user triggers:
$ vm.sh run_user 'id; dd if=/dev/zero of=/mnt/h2/f bs=32768 count=1 conv=notrunc; sync'
uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)
32768 bytes transferred in 0.000184 secs (177951559 bytes/sec)
USER-WRITE-OK
<hang — ssh session never returns>

# serial console (vm.sh log):
DOUBLE FAULT

Fatal double fault
rip = 0xffffffff8096f204      # nm: hammer2_chain_load_data (ffffffff8096f200 T hammer2_chain_load_data)
rsp = 0xfffff801193e5000      # kernel thread stack bottom (page-aligned)
rbp = 0xfffff801193e5000
cpuid = 4; lapic id = 4
panic: double fault
Trace beginning at frame 0xfffff80089663ec8
dblfault_handler() at dblfault_handler+0x10c
Debugger("panic")
db>

Full panic signature: panic.txt (same run).