DF-4012 fix validation -- FIXED production kernel
(DragonFly 6.5-DEVELOPMENT #1: Mon Oct 12 05:11:38 UTC 2026; both
twins' fix.diffs applied to /usr/src, make nativekernel, installkernel)
driving the FIXED mps_ioctl_devsw via the same rig, same uid=2
operator, same 0640 node.

(In-place log was re-truncated by a subsequent run; lines assembled
verbatim from the session transcript.)

$ su operator -c '/home/maxx/rig4012/trigger read 0'
DF4012 trigger: uid=2 euid=2 gid=5; BAR=0xfffff8008dbe0000 scan [0,0) cmd=0xc00c490a
read 0 = 0                                      <-- in-aperture READ still works
$ write 0x100 0x41414141 / read 0x100
write 0x100 = 0x41414141 ok                     <-- in-aperture WRITE still works
read 0x100 = 0x41414141
$ write 0x2000 0xdeadbeef                       <-- 2x aperture: was OOB-written+read-back on the vulnerable kernel
write 0x2000: errno=22 (Invalid argument)       <-- NOW REJECTED before any bus_space access
$ read 0x2000
read 0x2000: errno=22 (Invalid argument)
$ write 0x3000 0x41414141 / read 0x3000
write 0x3000: errno=22 (Invalid argument)
read 0x3000: errno=22 (Invalid argument)
$ write 0xfffffffc 0x41414141                   <-- max-u32 offset: PANICKED the vulnerable kernel (trap 12 in the
write 0xfffffffc: errno=22 (Invalid argument)       inline movl; see panic3 note in panic2.txt lineage)
Guest: up, healthy (uptime after both twins' runs).

Negative control observed during validation: with the rig's fake
struct resource initially mis-fabricated (r_start/r_end at the wrong
offsets), rman_get_size() computed a wrapped huge size and the fixed
kernel STILL performed the OOB write (Fatal trap 12, supervisor write,
mps_ioctl_devsw+0x14dd) -- proving the fixed handler's check path
executes and its strength is exactly the resource's true size.  After
correcting the fabrication to the DWARF-proven r_start@+0x28 /
r_end@+0x30 (aperture 0x1000), every out-of-aperture offset is
rejected as shown above.