--- a/sys/kern/subr_disk.c	2026-09-02 18:33:18.862281095 +0000
+++ b/sys/kern/subr_disk.c	2026-09-02 18:33:36.234063474 +0000
@@ -1189,6 +1189,17 @@
 	}
 
 	if (ap->a_cmd == DIOCRECLUSTER && dev == dp->d_cdev) {
+		/*
+		 * DF-2874: wiring a kernel-side raw-disk dmsg server to an
+		 * arbitrary fd turns the kernel into a root-credential
+		 * proxy for the peer (dev_dopen with proc0.p_ucred and
+		 * unrestricted raw strategy); require write access to the
+		 * device node as defense-in-depth.
+		 */
+		if ((ap->a_fflag & FWRITE) == 0) {
+			error = EPERM;
+			return error;
+		}
 		error = disk_iocom_ioctl(dp, ap->a_cmd, ap->a_data);
 		return error;
 	}