+ find /usr/obj/usr/src/sys/dev/misc/nmdm -name nmdm.ko -ls
 96930       16 -rw-r--r--    1 root                             wheel                                9544 Sep 23 08:40 /usr/obj/usr/src/sys/dev/misc/nmdm/nmdm.ko
+ find /usr/obj/usr/src/sys/dev/misc/nmdm -name nmdm.ko
+ head -1
+ KO=/usr/obj/usr/src/sys/dev/misc/nmdm/nmdm.ko
+ cp -p /usr/obj/usr/src/sys/dev/misc/nmdm/nmdm.ko /boot/kernel/nmdm.ko
+ kldunload nmdm
+ kldload nmdm
+ ls -l /dev/nmdm0A /dev/nmdm0B
crw-rw-rw-  1 root  wheel   32, 0x00000000 Sep 23 08:30 /dev/nmdm0A
crw-rw-rw-  1 root  wheel   32, 0x00000001 Sep 23 08:30 /dev/nmdm0B
+ echo '=== PATCHED MODULE: DF-4750 check (unpriv maxx) ==='
+ su maxx -c /tmp/nmdm_probe
=== PATCHED MODULE: DF-4750 check (unpriv maxx) ===
== DF-4749: reopen of an open nmdm half ==
open#1(/dev/nmdm0A)          = 3  [ok, TS_ISOPEN set]
open#2(/dev/nmdm0A)          = 4  [correct: reopen allowed]
open#3 after close(#1)       = 3  [ok: fresh first-open works, proves EBUSY above came from the pt_prison check]

== DF-4750: TIOCCDTR inverted mask ==
TIOCMSET(LE|DTR|RTS)         = 0
TIOCMGET after SET           = 0x0007 (LE=1 DTR=1 RTS=1)
TIOCCDTR                     = 0
TIOCMGET after TIOCCDTR      = 0x0005 -> DTR=clear [correct] RTS=SET [correct]
=== PATCHED MODULE: DF-4749 jail check ===
+ echo '=== PATCHED MODULE: DF-4749 jail check ==='
+ rm -f /tmp/holderjail.log /tmp/holdermaxx.log
+ sleep 3
+ jail / nmdmj2 127.0.0.1 /bin/sh -c '/tmp/holder /dev/nmdm0A > /tmp/holderjail.log 2>&1 & sleep 1; cat /tmp/holderjail.log; echo "-- same-jail reopen (expect open#1 OK now):"; /tmp/nmdm_probe || true'
holder: open(/dev/nmdm0A)=3 holding 60s
-- same-jail reopen (expect open#1 OK now):
== DF-4749: reopen of an open nmdm half ==
open#1(/dev/nmdm0A)          = 3  [ok, TS_ISOPEN set]
open#2(/dev/nmdm0A)          = 4  [correct: reopen allowed]
open#3 after close(#1)       = 3  [ok: fresh first-open works, proves EBUSY above came from the pt_prison check]

== DF-4750: TIOCCDTR inverted mask ==
TIOCMSET(LE|DTR|RTS)         = 0
TIOCMGET after SET           = 0x0007 (LE=1 DTR=1 RTS=1)
TIOCCDTR                     = 0
TIOCMGET after TIOCCDTR      = 0x0005 -> DTR=clear [correct] RTS=SET [correct]
-- unjailed unpriv attach to jail-held half (expect EBUSY now):
+ echo '-- unjailed unpriv attach to jail-held half (expect EBUSY now):'
+ su maxx -c '/tmp/holder /dev/nmdm0A > /tmp/holdermaxx.log 2>&1; cat /tmp/holdermaxx.log'
holder: open(/dev/nmdm0A) FAILED: Device busy
+ pkill -f 'holder /dev/nmdm0A'
DONE
+ echo DONE