Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address	= 0xfffff80065b4700c
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff82603edd
stack pointer	        = 0x10:0xfffff801185ff4c8
frame pointer	        = 0x10:0xfffff801185ff548
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 1, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1592
current thread          = pri 6
kernel: type 12 trap, code=2

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      hpfs_addextentr+0xed:   movl    %edx,(%r12,%rax,1)
db>

Trigger: unprivileged pwrite(2) (uid 1001) on crafted HPFS image,
variant=alsec freeoff=0x1000 -> AL_SET(AB_FREEALP(rabp)) writes the
12-byte alleaf {al_off=1, al_len=0x41, al_lsn=0x200} at
bp->b_data + 12 + 0x1000  (4 KB past the 512-byte AlSec buffer).

Baseline run 1 (freeoff=500, write exactly at b_data[512..524), 0 bytes
past the buffer): pwrite returned 32768, guest stayed alive -> silent
corruption of the adjacent 512-byte kernel heap chunk.

Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026
X86_64_GENERIC (stock INVARIANTS kernel).