guest_uname: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
fixed_kernel_uname: DragonFly 6.5-DEVELOPMENT #1: Mon Oct 12 12:33:28 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC
compiler: cc 8.3 [DragonFly] Release/2019-02-22
kern.osreldate: 600519
kernel: stock INVARIANTS X86_64_GENERIC (clean-source `with-src` snapshot); fix validated on a single-fix rebuild of the same config
NFS: in-kernel client, NFSv3 over UDP, AUTH_SYS
mount used: mount_nfs -o port=2049,udp,acregmin=1,acregmax=1,acdirmin=1,acdirmax=1 127.0.0.1:/P /mnt
  (1s attribute caches so server lies land deterministically on the next stat; with stock cache timing the same retypes fire after up to ~60s)
guest services during PoC: only the PoC's userland fakesrv2998 (rpcbind :111, mountd :779, nfs :2049, control :7798 on 127.0.0.1); system rpcbind/nfsd NOT running
vfs.nfs.nfs_privport = 0
unprivileged test user: maxx (TEST 1b ran the identical retype sequence as maxx)
code hashes (final sources):
  fakesrv2998.c  sha256 52302ba4088fb0943cf6b3f462a31522c9dbb147878e9433df9ca9ba8b7380bb
  trigger2998.c  sha256 14c6b6041e9f71f5ca38c03537a26ffae7a7ba7f64c3d623f9e333a4e1bc3ece