# DF-2970 PoC evidence pack

## What
linesw[] registry accepts conflicting registrations and deregisters in-use disciplines with no validation.

## Build
```
make (KMOD dfv_safe); cc dfv0pty.c
```

## Run
```
kldload ng_tty; kldload dfv_safe.ko; sysctl -w dfv.l2970=1; ./dfv0pty 8 &; sysctl -w dfv.l2970=2; ... =3
```

## Expected
ldisc_register(6, fake) silently accepted over live registration; deregister-in-use accepted; l_open=1 l_close=0

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
All logs are full untrimmed captures unless noted. fix.diff is the
git-apply-able verified fix (authored after verification; never applied
to the audit tree).