# DF-2874 baseline (stock kernel), reconstructed decisive lines:

[root] /tmp/dfpeer openwr /dev/vbd0 3
frame: cmd=80001106 msgid=fffff8011759b980 err=0 aux=0      <- kernel LNK_CONN|CREATE (msgid = kernel pointer, see DF-2708)
frame: cmd=a80fff01 msgid=0000000000010000 err=0 aux=0      <- BLK_OPEN reply
BLK_OPEN modes=3 -> reply cmd=a80fff01 error=0
   => dev_dopen(dp->d_rawdev, FREAD|FWRITE, S_IFCHR, proc0.p_ucred, ...) SUCCEEDED
      (sys/kern/subr_diskiocom.c:281-282) - kernel opened raw boot disk RW
      with root credentials at the message peer's request.

[root] /tmp/dfpeer write /dev/vbd0 32195477504 4096 0xc7
BLK_WRITE off=32195477504 len=4096 pat=c3 -> reply error=0
[root] dd if=/dev/vbd0 bs=4096 count=1 skip=7860224 | md5   -> 9ece48acd4dc2baf7b362dc153ed0906 (0xc3 fill)
   => unpriv-position write LANDED on the raw disk (root dd verified).

[root] /tmp/dfpeer read /dev/vbd0 32195477504 512
read off=... -> reply error=0 resid=0 aux=512; aux = c7 c7 c7 ...
   => raw read-back through the channel works.

# Unprivileged chain (run_f1.sh), stock kernel:
[poc@operator] dd if=/dev/zero of=/dev/vbd0 bs=512 count=1
dd: /dev/vbd0: Permission denied                       <- devfs perms (0640 root:operator)
[poc@operator] open("/dev/vbd0", O_RDONLY) via dfpeer attach
peer: open(dev): Operation not permitted                <- diskopen() SYSCAP_RESTRICTEDROOT
                                                        (sys/kern/subr_disk.c:78-80) BLOCKS
                                                        the unpriv path before DIOCRECLUSTER.
=> unpriv claim not reproducible on this system; root-cred proxy verified at peer position.