# DF-4749 — nmdm prison guard never initialized (`pt_prison` never assigned)

## Build (on the guest, any user)
```sh
cc -O -Wall -o /tmp/nmdm_probe nmdm_probe.c     # probe: open-matrix + TIOCM* checks
cc -O -o /tmp/holder holder.c                   # fd holder used for the jail demo
```

## Run
Root prerequisites (once): `kldload nmdm` (creates /dev/nmdm0A,B at 0666).

1. Unprivileged baseline: as any non-root user run `/tmp/nmdm_probe`.
   Expected (buggy kernel): `open#2` SUCCEEDS — for unjailed users the
   prison check at sys/dev/misc/nmdm/nmdm.c:211 can never fire because
   `pti->pt_prison` is NULL and unjailed `cr_prison` is NULL too
   (sys/kern/kern_prot.c:1223).
2. Jail demo (as root):
   ```sh
   jail / nmdmj 127.0.0.1 /bin/sh -c \
     '/tmp/holder /dev/nmdm0A >/tmp/h.log 2>&1 & sleep 1; /tmp/nmdm_probe'
   ```
   Expected (buggy kernel): the jailed `open#1` FAILS with `Device busy`
   although the holder runs in the *same* jail — `NULL != &jail` is always
   true for jailed creds.
3. While the jailed holder still sleeps, as an unprivileged *host* user:
   `/tmp/holder /dev/nmdm0A` — Expected (buggy kernel): open SUCCEEDS; the
   host user now shares a tty half pinned (by design intent) to the jail.

## Success criterion
The bug is proven when: (a) same-jail reopen returns EBUSY, and
(b) unjailed attach to a jail-held half succeeds. After the fix both invert
(same-jail reopen allowed; cross-prison attach EBUSY) — see fix_run.log.

## Full logs
`run.log` (pre-fix), `jailtest_baseline.log` (raw jail run),
`fix_build.log` + `fix_run.log` (patched-module A/B), `env.txt`.