=== baseline run (stock kernel #0 Jul 2 2026) ===
$ vm.sh run_root 'kldload /tmp/df2773.ko; echo RC=$?'  (ssh hangs)
Fatal trap 12: page fault while in kernel mode
cpuid = 5; lapic id = 5
fault virtual address	= 0x0
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff80b91a3e
stack pointer	        = 0x10:0xfffff80117e9d688
frame pointer	        = 0x10:0xfffff80117e9d6a8
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 837
current thread          = pri 6 
kernel: type 12 trap, code=0

CPU5 stopping CPUs: 0x0000001f
 stopped
Stopped at      link_elf_obj_unload_file+0x6e:  movq    (%rax),%rdi
db> 
console context: 'Fatal user address access from kernel mode from kldload at ffffffff80b91a3e'

=== patched run (kernel #1 Sep 1 01:04:57 2026, fix.diff applied) ===
$ vm.sh run_root 'kldload /tmp/df2773.ko; echo RC=$?'
kldload: an error occurred while loading module /tmp/df2773.ko. Please check dmesg(8) for more details.
RC=1
$ dmesg | tail: linker_load_file: Unsupported file type   (scan-time sh_info rejection)
ALL-SURVIVED; uptime 1 min; 0 panics in console log