Guest environment for DF-3332 verification (2026-09-11).

uname -a:
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

kern.ident = X86_64_GENERIC, 6 CPUs, 4 GB RAM, virtio (vtnet0, lo0).

# netmap subsystem availability on this guest/tree
- /dev/netmap: DOES NOT EXIST (no netmap.ko anywhere in /boot/kernel)
- # kldload netmap
  kldload: can't load netmap: No such file or directory
- # cd /usr/src/sys/net/netmap && make
  dragonfly/net/netmap/netmap_kern.h:747:27: error: 'struct ifnet' has no
      member named 'if_unused7'; did you mean 'if_unused2'?
  (15 hard errors in netmap.c alone — subsystem bit-rotted; also no
   'netmap' entries in sys/conf/files and no kernel config includes it)
  => the netmap attack surface is DEAD on stock current DragonFly; the
     verbatim-function KLD approach (df3332_kmod.c) is used for the
     real-kernel demonstration instead.
- The code lineage is FreeBSD netmap.c r257176 (imported), where the same
  loop was reachable on any netmap-enabled system.

# PoC module build (final successful)
cc -O2 -pipe -D_KERNEL -Wall ... -Werror -DKLD_MODULE ... -c df3332_kmod.c
cc -Wl,--build-id=sha1 -nostdlib ... -r -o df3332.ko df3332_kmod.o
(full output: build.log)

# Decisive runs (see dmesg.txt, run.kernelflood.full.log, panic.txt)
1. diagnostic vulnerable : k=1025 lim=1023 -> 10241 iters, bailed
2. diagnostic fixed      : k=1023 -> 1023 iters, terminated
3. pure mode vulnerable  : sysctl never returned; load 0.00 -> 0.63+;
   40,088 console flood lines; ssh logins stall; shutdown never completes;
   QEMU force-killed for cleanup.