# DF-2901 PoC evidence pack

## What
hammer2 bulkfree uses kmem_alloc_swapbacked result unchecked; the unpriv ioctl path to the alloc is live-verified.

## Build
```
cc -o df2901 df2901.c
```

## Run
```
as unpriv: ./df2901 /mnt/h2 (any hammer2 directory)
```

## Expected
unpriv ioctl run: BULKFREE_SCAN ACCEPTED for uid=1001 (sstop=whole volume); NULL form not triggerable

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
All logs are full untrimmed captures unless noted. fix.diff is the
git-apply-able verified fix (authored after verification; never applied
to the audit tree).