# DF-2907 PoC evidence pack

## What
md_get_mbuf ignores md_get_mem failure; md_done leaves md_cur/md_pos dangling.

## Build
```
make (KMOD dfv_boom with KERNBUILDDIR)
```

## Run
```
kldload smbfs; kldload dfv_boom.ko; sysctl -w dfvboom.m2907=1
```

## Expected
safe form: md_done leaves md_cur/md_pos dangling + stale m_len read; panic form: panic: m_copym: length > size of mbuf chain

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
All logs are full untrimmed captures unless noted. fix.diff is the
git-apply-able verified fix (authored after verification; never applied
to the audit tree).