DF-2667 re-run on the PATCHED kernel (#1, both fixes), as unprivileged user (uid 1001):

  DF-2667: uid=1001 euid=1001, calling mountctl("/", MOUNTCTL_MOUNTFLAGS, fd=-1, ctl=NULL, ctllen=0, buf=NULL, buflen=0)
  DF-2667: mountctl returned -1 (no crash)
  EXIT=0
  DragonFly dfbsd 6.5-DEVELOPMENT #1: Sun Aug 30 10:16:19 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

mountctl(2) now returns EINVAL (-1) for the degenerate buflen==0 request;
no page fault, no panic, guest remains up. Positive control with a real
buffer still returns the flag string ("local", 5 bytes).