DF-2626 guest environment (stock kernel, evidence captured 2026-08-28)

uname -a (stock, vulnerable):
  DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

uname -v (patched, fix-validated):
  DragonFly 6.5-DEVELOPMENT #1: Fri Aug 28 20:29:47 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC

kernel config: X86_64_GENERIC (INVARIANTS included; module build line shows -DINVARIANTS)
CPUs: hw.ncpu = 6
root filesystem: vbd0s1d on / (hammer2, local)   <- guest root fs IS hammer2
/tmp: tmpfs on /tmp (tmpfs, local)               <- control filesystem
users: root; maxx (uid 1001, unprivileged) — PoC run as maxx
compiler: /usr/bin/cc (gcc80-base, CCVER=gcc80)
QEMU/KVM single-tenant guest via dfbsd-qemu/vm.sh (no SMAP/SMEP/KASLR — irrelevant here, no memory corruption)

mount (excerpt):
  vbd0s1d on / (hammer2, local)
  tmpfs on /tmp (tmpfs, local)
  tmpfs on /var/run/shm (tmpfs, local)

files used as read targets (all hammer2, world-readable):
  /etc/rc /etc/defaults/rc.conf /bin/sh /usr/bin/cc /etc/passwd /etc/protocols
symlink used for readlink vector: /home/maxx/df2626link -> /etc/rc (on hammer2)