Guest environment (single-tenant QEMU/KVM, dfbsd-qemu/vm.sh)
------------------------------------------------------------
STOCK kernel (baseline, snapshots "clean-source"/"clean-install"):
  DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
      root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
  hw.ncpu: 6
  INVARIANTS kernel (gtask_dump()/panic("queue == NULL") path present and firing)
  MAXCPU = SMP_MAXCPU = 256 (sys/cpu/x86_64/include/param.h:71)
  sizeof(struct taskqgroup) <= 6252 bytes (array 6144 + lock + name + cnt)

FIXED kernel (this run's fix-validation build):
  DragonFly 6.5-DEVELOPMENT #1: Wed Sep  2 09:11:43 UTC 2026
      root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC
  built in-guest: cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC &&
                  make installkernel KERNCONF=X86_64_GENERIC   (see fixbuild.log)

Toolchain: CCVER=gcc80 (cc 8.x), out-of-tree KLD builds with
  make -m /usr/share/mk SYSDIR=/usr/src/sys
  plus symlinks of device_if.h/bus_if.h from
  /usr/obj/usr/src/sys/X86_64_GENERIC into the module directory.

gtaskqueue subsystem state on this guest: identical to source tree;
NO in-tree consumers (only TASKQGROUP_DEFINE(softirq, ncpus, 1) boot
glue), so nothing in the running system touches the vulnerable API
before the PoC modules are loaded.