DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
change host ::1
ptb6: conn [::1].4530 <-> [::1].49180
before-PTB : t_state=5 t_maxseg=14336 t_maxopd=16324 t_rttupdated=41 snd_ssthresh=28672 snd_cwnd=28676
ptb6: injected ICMPv6 PTB mtu=60 quoting ::1.4530 -> ::1.49180
after-PTB  : t_state=5 t_maxseg=0 t_maxopd=0 t_rttupdated=41 snd_ssthresh=28672 snd_cwnd=28676
ptb6: -x given; sleeping so you can inspect
=== full run (close => panic). Serial console capture:

-- fatal trap (from panic.txt, identical on both fatal reproductions) --
  Fatal trap 18: integer divide fault while in kernel mode
  cpuid = 0; lapic id = 0
  instruction pointer	= 0x8:0xffffffff807c403e
  stack pointer	        = 0x10:0xfffff8008d1f89a0
  frame pointer	        = 0x10:0xfffff8008d1f8a50
  code segment		=  base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
  processor eflags	= interrupt enabled, resume, IOPL = 0
  current process	= Idle            <- netisr0 context (so_pcbdetach netmsg)
  current thread          = pri 12 (CRIT)
  kernel: type 18 trap, code=0

  CPU0 stopping CPUs: 0x0000003e
   stopped
  Stopped at      tcp_close+0x66e:        divq    %r8,%eax

Interpretation:
  * trap 18 = x86 #DE (integer divide error); the faulting instruction is
    the division in tcp_close() at sys/netinet/tcp_subr.c:1013
        i = (i + tp->t_maxseg / 2) / tp->t_maxseg;
    with tp->t_maxseg == 0 (u_int, tcp_var.h:223), set by tcp_mtudisc()
    (tcp_subr.c:1852-1871) from the forged ICMPv6 PTB's mtu=60
    (maxopd = 60 - 40 - 20 = 0).
  * "MSS (0) too small to hold options!" is the kernel's own tcp_output
    diagnostic firing on the corrupted tcpcb between the PTB and the close.
  * current process = Idle => the close ran from netisr0 via the socket
    detach netmsg => whole-system panic (fatal trap), not a per-process
    signal.  In the runs where the divide fault hit while the closing
    process was current, DFly delivered signal 11 to the process instead.