# DF-2772 — `findbase()==0` → `panic("lost base for relatab")` on REL/RELA whose sh_info doesn't name a loaded section

## Build (host)
```
python3 gen_module.py df2772.ko panic-rela
```

## Run (guest, root — kldload is SYSCAP_NOKLD-gated)
```
scp -F dfbsd-qemu/config df2772.ko dfbsd:/tmp/
dfbsd-qemu/vm.sh run_root 'kldload /tmp/df2772.ko'
```

## Expected — stock kernel (baseline, reproduced twice)
Serial console (panic.txt):
```
panic: lost base for relatab
link_elf_obj_reloc_local() at link_elf_obj_reloc_local+0x28f
link_elf_obj_load_file() at link_elf_obj_load_file+0xb6f
linker_load_file.part.3() ... sys_kldload() ...
Debugger("panic")
```
The module's single .rela section carries `sh_info = 0` (the SHT_NULL
section). The scan stores it verbatim (`sec = sh_info`, link_elf_obj.c:355/:775),
and since section 0 never becomes a progtab entry, `findbase()` returns 0 and
`link_elf_obj_reloc_local` (called during load, :818→:1243-1245 / during boot
for preloads :368) executes `panic("lost base for relatab")` instead of
rejecting the file. Same shape at :975-977/:1002-1004 in `relocate_file`.

## Expected — patched kernel (fix.diff applied, kernel #1 Sep 1 2026)
```
kldload: an error occurred while loading module /tmp/df2772.ko ...
RC=1
dmesg: linker_load_file: Unsupported file type
```
Module rejected at scan time by `elf_obj_reloc_target_ok()`, no panic, guest up.

## Threat model
Root-supplied-input class (SYSCAP_NOKLD), like DF-0040/0041/0042. The same
panic is also reachable from the **preload** path (boot-time module metadata),
so a corrupted/substituted preloaded module bricks the boot.