Guest:       DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Compiler:    cc 8.3 [DragonFly] Release/2019-02-22
Modules:     dm.ko (+dm_target_error/zero loaded by dm), nmdm.ko
Device:      /dev/mapper/control (make_dev 0640 root:operator, device-mapper.c:181)
Test user:   root (only root is in group operator on this guest) — kldunload
             requires root; the ioctl side alone is operator-group reachable.
Crash host:  QEMU/KVM, no SMAP/SMEP/KASLR, serial console logged to boot.log
Runs:        run1 dirty guest (panic dev_dioctl+0x1b); run2 fresh reset guest
             (panic IP=0x0); run3 fix-v1 patched dm.ko (panic freed text);
             run4 fix-v2 patched dm.ko (panic dmioctl+0x2bf). Every crashing
             run also printed `malloc_uninit: 1984 bytes of 'dm' still
             allocated`.