=== guest uname ===
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

=== real kernel image: static layout around sccngetch() statics ===
ffffffff80b7c0c0 T genkbd_get_fkeystr
ffffffff817a6da0 b fkeycp.13185
ffffffff817a6db0 b fkey.13184

=== replica harness: pun store + unclamped bcopy ===
sizeof(size_t)=8 sizeof(int)=4 sizeof(struct fkeytab)=17
model: fkeycp @+32, fkey @+48, guard1 @+65
[1] 8-byte size_t store at &fkeycp (len=5):
  fkeycp=5 (low 4 bytes: the length)
  OOB bytes [fkeycp+4 .. fkeycp+8) modified bytes: [4]=00 [5]=00 [6]=00 [7]=00
  => bytes 4..7 of the store land OUTSIDE the 4-byte int (in the real kernel: the alignment gap before fkey.13184)
[2] bcopy with corrupted len=255 into fkey.str[16]:
  bytes after fkey.str[16] (kernel: .bss objects after fkey.13184) modified bytes: [64]=10 [65]=11 [66]=12 [67]=13 [68]=14 [69]=15 [70]=16 [71]=17 [72]=18 [73]=19 [74]=1a [75]=1b [76]=1c [77]=1d [78]=1e [79]=1f [80]=20 [81]=21 [82]=22 [83]=23 [84]=24 [85]=25 [86]=26 [87]=27 [88]=28 [89]=29 [90]=2a [91]=2b [92]=2c [93]=2d [94]=2e [95]=2f [96]=30
  => 239 bytes written past the end of the 17-byte static fkey object