Diagnostic run (armed allocation RF_SHAREABLE + kprintf probes, guest 6.5-DEVELOPMENT X86_64_GENERIC):
console output at panic (from QEMU serial boot.log, captured 2026-09-24 02:01 UTC):

  ppc0: <Standard parallel printer port> port 0x378-0x37f irq 7 on acpi0
  ppc0: Generic chipset (NIBBLE-only) in COMPATIBLE mode
  ppbus0: <Parallel port bus> on ppc0
  ppi0: <Parallel I/O> on ppbus0
  PPIDIAG: attach intr_resource=0xfffff8008d466848 irq=7
  interrupt uses mplock: ppc0
  sio2: can't drain, serial port might not exist, disabling

  DragonFly/x86_64 (dfbsd) (ttyd0)

  login: interrupt uses mplock: ppi0
  PPIDIAG: ppiintr entered, arg=0xfffff80116a12e00

  Fatal trap 12: page fault while in kernel mode
  cpuid = 1; lapic id = 1
  fault virtual address	= 0x0
  fault code		= supervisor read data, page not present
  instruction pointer	= 0x8:0xffffffff82604672
  stack pointer	        = 0x10:0xfffff8011847b9a0
  frame pointer	        = 0x10:0xfffff8011847b9d0
  code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
  processor eflags	= interrupt enabled, resume, IOPL = 0
  current process		= Idle
  current thread          = pri 28 (CRIT)
  kernel: type 12 trap, code=0

  CPU1 stopping CPUs: 0x0000003d
   stopped
  Stopped at      ppiintr+0x52:   movq    (%rax),%rsi
  db>

Interpretation:
- arg=0xfffff80116a12e00 is the *cdev_t* for /dev/ppi0 passed by ppiopen()
  (ppi.c:268 `ppiintr, dev`), NOT the device_t ppiintr expects (ppi.c:187).
- ppiintr+0x52 is the first dereference through the type-confused pointer
  chain: ppi_disable_intr(ppidev=cdev) -> device_get_parent(cdev) reads
  cdev+0x28 (= link.tqe_prev, the cdev TAILQ linkage) -> garbage "ppbus" ->
  ppb_rctr(ppbus) -> PPBUS_IO(device_get_parent(ppbus)) -> NULL -> fault at 0x0.
- Trap 12 in interrupt context (current process = Idle, pri CRIT) is fatal:
  kernel panic / DDB, all CPUs stopped. Instant, permanent local DoS.