DF-2667 + DF-2668 fix validation (single rebuilt kernel carrying both fixes)
===========================================================================

Patches applied to guest /usr/src (both from evidence-pack fix.diff files):

  # cd /usr/src && patch -p1 --dry-run < /tmp/fix2667.diff && patch -p1 --dry-run < /tmp/fix2668.diff
  Patching file sys/kern/vfs_subr.c using Plan A... Hunk #1 succeeded at 1985. Hunk #2 succeeded at 2012.
  Patching file sys/kern/vfs_syscalls.c using Plan A... Hunk #1 succeeded at 5071. Hunk #2 succeeded at 5131.
  # patch -p1 < /tmp/fix2667.diff && patch -p1 < /tmp/fix2668.diff
  ... PATCHED
  # grep -c "mp = vp->v_mount" sys/kern/vfs_syscalls.c
  1                      (only the legitimate sys_mount MNT_UPDATE use at :239 remains)
  # grep -n "buf == NULL || len == 0" sys/kern/vfs_subr.c
  1994:	if (buf == NULL || len == 0) {

Kernel rebuild (6 jobs, INVARIANTS config X86_64_GENERIC):
  # cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC && make installkernel KERNCONF=X86_64_GENERIC
  ... (37822 log lines; both vfs_subr.c and vfs_syscalls.c compiled; no errors)
  DONE_RC=0
  # reboot

Patched kernel booted:
  DragonFly dfbsd 6.5-DEVELOPMENT #1: Sun Aug 30 10:16:19 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC

(Note: /tmp/kbuild.log itself lived on tmpfs and was lost at reboot; the
verifiable artifacts are the applied sources, DONE_RC=0, kernel #1's uname,
and the re-run results below.)

DF-2667 re-run as UNPRIVILEGED user (baseline: panic):
  DF-2667: uid=1001 euid=1001, calling mountctl("/", MOUNTCTL_MOUNTFLAGS, fd=-1, ctl=NULL, ctllen=0, buf=NULL, buflen=0)
  DF-2667: mountctl returned -1 (no crash)          <-- EINVAL, guest stays up
  DragonFly dfbsd 6.5-DEVELOPMENT #1: Sun Aug 30 10:16:19 UTC 2026 ... (still up)

DF-2667 positive control (proper 256-byte buffer, patched kernel):
  rv=5 (bytes stored), flags=[local]                <-- MOUNTCTL_MOUNTFLAGS still works

DF-2668 re-run as root (baseline: panic in mount_drop):
  # mount -t null /tmp /tmp/nmtest
  /tmp on /tmp/nmtest (null, local)
  # /tmp/df2668 /tmp/nmtest/anchor_file
  DF-2668: getfh(/tmp/nmtest/anchor_file) ok; fh_fsid = 89630026,0000000b
  DF-2668: fhstatfs returned ok f_type=0            <-- no panic, valid statfs data
  DF-2668: survived fhstatfs (no KKASSERT?)
  EXIT=0
  # umount /tmp/nmtest && echo NULLFS-UNMOUNTED-OK  <-- mount lifecycle intact
  NULLFS-UNMOUNTED-OK

VERDICT: both regressions fixed (baseline panics gone, correct error/data
returned), no functional regression in the positive control.