Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026
       root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
       STOCK kernel (INVARIANTS), same binary as the standard 6-vCPU guest;
       exploitation instantiation = 2 vCPU (dfbsd-qemu/forensic2cpu.sh),
       QEMU/KVM, 4GB, gdbstub :1235, serial log, no SMAP/SMEP/KASLR.
User:  maxx, uid=1001 (unprivileged). /dev/ptmx mode 0666.
Build: cc -O2 -pthread -o dx df3017d.c   (DragonFly cc, guest)
Run:   /tmp/dx 90 850 150 4   (as maxx; driver tightloop3.sh)
Harvest per boot: /tmp/nf 700 (nodefree) + walkzones.py 22 (gdbstub
node-template walk; production source = DF-2694 arbitrary read).
Wins:  2026-10-17 07:34 UTC (tickets=386, 0.9s) and 07:47 UTC
       (tickets=497, 1.4s): uid=0(root) euid=0, serial marker
       "DF3017-CHAIN-WON uid=0", /tmp/df3017.root owned root:wheel.