# DF-4472 PoC — uninitialized `type` pointer in dm_table_load_ioctl

**Build** (guest, after `vm.sh reset with-src` + `kldload dm`):

```sh
cc -o dm_uninit_type dm_uninit_type.c -lprop -lpthread
```

**Run**:

```sh
./dm_uninit_type            # groom mode: 200 rounds of [valid reload, typeless reload]
./dm_uninit_type --flood 8 800   # 8 threads x 800 malformed reloads (panic variant)
```

**Expected (unpatched)** — any of:

* groom: `destroy-proof=N` == rounds — every typeless reload returns ENOENT
  (rv2=2) *and* wipes the inactive table loaded by the paired valid reload,
  proving `dm_target_lookup(garbage)` executed (dm_ioctl.c:741 is the only
  ENOENT return after the destroy at :722-723);
* flood: kernel panic — `Fatal trap 12`, `Stopped at strcmp+0xc`
  (wild read of the uninitialized pointer), guest down;
* possibly `dm: could not autoload module for target <garbage>` on console.

**Expected (patched with fix.diff)**: groom prints `last rv2=22` (EINVAL)
with `destroy-proof=0`; flood completes `without panic`.

Requires root (or operator group): /dev/mapper/control is 0640 root:operator.