DF-4672 fix A/B — DF467XFIX kernel (X86_64_GENERIC + device bktr + fix.diff)
DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Oct 15 00:54:24 UTC 2026 (DF467XFIX)
video_ioctl now a kernel global (0xffffffff80830790) = FIXED production code.
Rig: bktrig2_nodep.ko (same rig; production symbols resolve from the kernel).

== attack (unpriv, uid 1001): poc_wireleak 128 40
RIG_INIT: bigbuf=0xfffff80118490000 alloc_pages=256
start: wire=124087   idle noise over 3s: 288
grow # 3 -> alloc_pages= 384 wire_delta= +0
grow # 4 -> alloc_pages=1022 wire_delta= +0
grow # 8 -> alloc_pages=2044 wire_delta= +7
grow #16 -> alloc_pages=3065 wire_delta= +6
grow #24 -> alloc_pages=4086 wire_delta= +8
grow #32 -> alloc_pages=5107 wire_delta= +0
grow #40 -> alloc_pages=6128 wire_delta= +0

== RESULT ==
successful grows: 7 (all unprivileged)
pages allocated by grows: 21831 (85.3 MiB)
wire delta (permanent): 22 pages (0.1 MiB)  [== noise]
final vm.stats.vm.v_wire_count: 124397

BASELINE (stock kernel, same rig): +52,137 pages (203.7 MiB) permanent for
~1/6 of the allocation volume, reserve permanently drained.  FIXED: leak
GONE (contigfree returns both reserve blocks and wired pages; KVA reuse
safe because contigfree removes the stale PTEs).