Guest (single-tenant QEMU/KVM target for this audit):
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026
root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

PCI inventory (pciconf -l, filtered for vendor 0x11ab Marvell/HighPoint and 0x14e4 Broadcom):
NO_HPTMV_NO_BRCM_PCI  <- no HighPoint RR1820 (hptmv) device, no Broadcom siba/bwn device present

Device nodes:
/dev/hptmv: does not exist (driver never attached: no matching PCI ID)
/dev/pass0: crw------- root operator (0600); operator group = root only
/dev/xpt0 : crw------- root operator
kern.securelevel = -1
kldstat: no hptmv, bwn, or siba modules loaded

Conclusion: the audited driver's hardware (HighPoint RR1820 / Broadcom SSB wifi) is ABSENT
from the verification guest. All runtime PoC triggers for this batch are hardware-gated and
cannot manifest on this guest; verdicts are source-level-certain, runtime not_reproduced.
Privilege note (entry.c findings): the only user-reachable path into hpt_action with an
attacker-controlled CDB is /dev/passN CAMIOCOMMAND, gated by passopen()'s
caps_priv_check_self(SYSCAP_RESTRICTEDROOT) (sys/bus/cam/scsi/scsi_pass.c:308) plus 0600
root:operator node permissions -> effectively root/operator-with-capability only.