DF-3023 fix-kernel build log (reconstructed from the live session captures;
the guest's /tmp/kbuild.log lived on the tmpfs /tmp and was wiped by the
validation reboot — the lines below are verbatim outputs captured during
the build/install/reboot sequence)

launch:
  $ cd /usr/src && make -j6 nativekernel        # after: patch -p0 < fix.diff (Hunk #1 succeeded at 690)

mid-build polls (verbatim excerpts):
  cc -c -O2 -pipe -Wall ... -std=gnu11 -g -nostdinc -I. -Iinclude ... -D_KERNEL
      -DHAVE_KERNEL_OPTION_HEADERS -include opt_global.h ... /usr/src/sys/kern/kern_nrandom.c -Werror
  --- kern_resource.o ---
  cc -c -O2 -pipe ... /usr/src/sys/contrib/dev/acpica/source/components/namespace/nswalk.c -Werror
  --- smbfs_vnops.o ---
  cc -O2 -pipe -D_KERNEL -Wall -Wredundant-decls ...

completion:
  >>> Kernel build for X86_64_GENERIC completed on Sat Sep  5 11:27:23 UTC 2026
  --------------------------------------------------------------
  BUILD_RC=0

install:
  $ cd /usr/src && make installkernel
  >>> Kernel install for X86_64_GENERIC completed on Sat Sep  5 11:33:51 UTC 2026
  INSTALL_RC=0
  $ shutdown -r now

patched boot:
  $ uname -v
  DragonFly 6.5-DEVELOPMENT #1: Sat Sep  5 11:23:49 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC
  $ grep -n "uio_offset < 0" /usr/src/sys/vfs/tmpfs/tmpfs_vnops.c
  559:	if (uio->uio_offset < 0)      # tmpfs_read (pre-existing)
  702:	if (uio->uio_offset < 0)      # tmpfs_write (fix.diff)

patched PoC rerun (run.patched.log):
  [probe ] pwrite(16384 @ -16384) = -1 errno=22 size=0
  [panic ] pwrite(32752 @ -32752) launching...
  [panic ] returned -1 errno=22 (kernel did NOT panic?)
  exit=0
  guest status after: up

regression sanity on patched kernel:
  write+pwrite+ftruncate: size=128 (expect 128) r=48
  REGRESSION_OK