DF-2898 fixed-kernel run — kernel built from pristine /usr/src + fix.diff only
(Kernel #1, "Thu Sep  3 03:11:47 UTC 2026"), same guest, same probes.

$ uname -v
DragonFly 6.5-DEVELOPMENT #1: Thu Sep  3 03:11:47 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC

$ /tmp/probe 2; /tmp/probe 3; /tmp/probe 4; /tmp/probe 5; /tmp/probe 6; /tmp/probe 7; /tmp/probe 8; /tmp/probe 1; echo ALL-PROBES-DONE rc=$?
Bad system call (core dumped)     # P2 raw rax=0,   rdi=0
Bad system call (core dumped)     # P3 raw rax=198, rdi=198
Bad system call (core dumped)     # P4 libc syscall(SYS_syscall, 20)
Bad system call (core dumped)     # P5 libc syscall(SYS_syscall, 197, ...)  ← original crasher
Bad system call (core dumped)     # P6 libc syscall(0, 0)
Bad system call (core dumped)     # P7 libc syscall(198, 198)
Bad system call (core dumped)     # P8 libc syscall(SYS___syscall, 20)
P1 returned 0x34e (846)           # P1 raw rax=0, rdi=20 — VALID indirect getpid still works
ALL-PROBES-DONE rc=0
$ vm.sh status → up     (no panic, guest healthy)

Baseline on stock kernel #0: P2-P7-class calls → DOUBLE FAULT / panic (see
panic-baseline.txt).  Fixed kernel: clean SIGSYS rejection, zero panics,
indirect gateway semantics preserved for valid targets.