=== FIXED KERNEL (fix.diff applied in guest scratch /usr/src, built via
=== make nativekernel KERNCONF=X86_64_GENERIC, installed, rebooted)
uname -v: DragonFly 6.5-DEVELOPMENT #1: Tue Oct 20 11:55:22 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC
sysctl vm.vkernel_enable: 0 -> 1

(command: /tmp/vmsp_abi as unpriv uid 1001 via run_user)
uid=1001 euid=1001 SYS_vmspace_create=486
[1] create(id=NULL,        type=0,   data=NULL) -> rc=-1 errno=22 (Invalid argument)  want -1/EINVAL
[2] create(id=NULL, ...) again            -> rc=-1 errno=22 (Invalid argument)  EEXIST proves NULL is a live RB key
[3] create(id=0x40000000, type=123, data=0xdead0000) -> rc=-1 errno=22 (Invalid argument)  want -1/EINVAL
[4] create(id=0x40000001, type=0,   data=NULL) -> rc=0 errno=0 (OK)  want 0 (legit use unchanged)
[c] destroy(id=NULL)       -> rc=-1 errno=2
[c] destroy(id=0x40000000)    -> rc=-1 errno=2
[c] destroy(id=0x40000001)    -> rc=0 errno=0
RESULT: null_id_accepted=0 typed_args_ignored=0
VERDICT: contract enforced (EINVAL) -- fixed kernel
ABI_EXIT=1
    -> NULL id and nonzero type/data now rejected with EINVAL;
       the documented normal call still succeeds; cleanups behave.

=== restore ===
sysctl vm.vkernel_enable: 1 -> 0
(then: vm.sh reset with-src -- guest returned to clean snapshot kernel)