Guest environment for DF-3389 verification (2026-10-20)

uname -a:
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0/#1:
  x86_64, /usr/obj/usr/src/sys/X86_64_GENERIC
  #0 Thu Jul  2 06:02:54 UTC 2026  (stock snapshot kernel)
  #1 Tue Oct 20 19:50:24 UTC 2026  (canary kernel)
  #1 Tue Oct 20 20:35:08 UTC 2026  (fixed kernel)

CPU/memory: QEMU/KVM, -smp 6, 4096 MB (hw.ncpu: 6)
kernel config: X86_64_GENERIC, options INVARIANTS (line 56)
NIC: virtio-net-pci (user-net, hostfwd ssh)
source: /usr/src md5-identical to audit tree (ip6_input.c 77adbb749dee02ae3a5622ac561639f2)

key sysctls during runs:
  net.inet6.ip6.forwarding: 0
  net.inet6.ip6.hdrnestlimit: 50
  net.inet6.ip6.dad_count: 1 -> 0 (set by harness so re-added addresses
                                    skip DAD and are instantly READY)
  net.inet6.ip6.df3389_{hits,defers,captures}: canary-only

attack identity:
  floods run as uid 1001 (maxx), unprivileged
  address cycling (SIOCAIFADDR_IN6/SIOCDIFADDR_IN6) run as root
    (matches the claimed threat model: unpriv traffic racing an
     administrative/daemon-driven address deletion — e.g. ifconfig
     scripts, SLAAC prefix expiry, temp-address rotation)

unrelated observation: full-rate SIOCDIFADDR_IN6 cycling (~3k/s) panics
  stock INVARIANTS kernels within ~60-120 s in nd6_timer_dispatch()
  (rt_llinfo != ln) — separate bug, evidence in
  logs/stock-nd6-panic-unrelated.txt and logs/canary-run1-and-nd6-panic2.txt