DF-2741 — kernel panic (reproduction #1 and #2, identical signature)
=====================================================================
(serial console, dfbsd-qemu/boot.log; guest DragonFly 6.5-DEVELOPMENT #0)

login: Aug 31 13:26:22 dfbsd kernel: vn1s1: cannot find label (no disk label)

Fatal trap 12: page fault while in kernel mode
cpuid = 5; lapic id = 5
fault virtual address	= 0x0
fault code		= supervisor read instruction, page not present
instruction pointer	= 0x8:0x0
stack pointer	        = 0x10:0xfffff8008d271a88
frame pointer	        = 0x10:0xfffff8008d271ab0
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= Idle
current thread          = pri 12 
kernel: type 12 trap, code=10

CPU5 stopping CPUs: 0x000f
 stopped
Stopped at      0:

Fatal trap 12: page fault while in kernel mode
cpuid = 5; lapic id = 5
fault virtual address	= 0x0
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff80bccb70
...
db> 

Interpretation: the kernel jumped to address 0 — a call through a function
pointer zeroed by the 29,184-byte mostly-zero overflow that DIOCGSLICEINFO
performs past its 4,128-byte ioctl buffer. Reproduced twice, both times
within ~30 s of starting the DIOCGSLICEINFO hammer loop on a 130-slice
GPT-backed vn device; control runs (no GPT disk attached) never panic.
Full serial logs: panic_boot.log / panic2_boot.log.