# Guest environment (audit QEMU/KVM target, dfbsd-qemu/vm.sh)
uname -a:
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

Compiler (userland harness builds): DragonFly cc 8.3 [DragonFly] Release/2019-02-22

# HARDWARE GATE (why no in-kernel reproduction is possible on this guest):
pciconf -l (complete bus, via root):
hostb0@pci0:0:0:0:    class=0x060000 card=0x11001af4 chip=0x12378086 rev=0x02
isab1@pci0:0:1:0:     class=0x060100 card=0x11001af4 chip=0x70008086 rev=0x00
atapci0@pci0:0:1:1:   class=0x010180 card=0x11001af4 chip=0x70108086 rev=0x00
none0@pci0:0:1:3:     class=0x068000 card=0x11001af4 chip=0x71138086 rev=0x03
vgapci0@pci0:2:0:     class=0x030000 card=0x11111234 chip=0x11111234 rev=0x02
virtio_pci0@pci0:0:3:0: class=0x020000 card=0x00011af4 chip=0x10001af4
virtio_pci1@pci0:0:4:0: class=0x010000 card=0x00021af4 chip=0x10011af4

- No LSI/Avago SAS2208/2308/3000 HBA on the bus: mpr(4) never attaches; every
  mpr_mapping.c path is dormant on this guest. Exercising the mapping engine
  requires an mpr-compatible IOC (real HBA, PCI passthrough, or a malicious
  emulator) - identical gate as the mps(4) twins DF-4085/DF-4086 and the
  earlier mpr findings DF-3914/DF-3915.
- kldstat: kernel + ehci.ko + xhci.ko only; no mpr.ko loaded.
- Guest is the intentional no-SMAP/SMEP/KASLR exploitation target; the
  limitation here is absent hardware, not hardening.

# Verification state left behind: NONE.
- /usr/src/sys/dev/raid/mpr/mpr_mapping.c restored to pristine after the fix
  build (md5 0dfb1866c50fa4c6d15f607acd7d729d == repo, patch -R verified,
  no fix strings remain, directory back to its original 15 files).
- Userland harness scratch dir removed. guest_dirty = 0.