# DF-2985 PoC evidence pack

## What
sysent[] swaps are unsynchronized against unlocked syscall dispatch: torn dispatch / wild kernel execution.

## Build
```
make (KMOD dfv_safe); cc dfv5call.c
```

## Run
```
kldload dfv_safe.ko; sysctl -w dfv.s2985=3; ./dfv5call 5 (calibration); sysctl -w dfv.s2985=2; sysctl -w dfv.s2985=1; ./dfv5call 15 -> kernel panics
```

## Expected
calibration clean; every unsynchronized flip run: Fatal trap 1 privileged instruction fault (garbage execution)

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
All logs are full untrimmed captures unless noted. fix.diff is the
git-apply-able verified fix (authored after verification; never applied
to the audit tree).