=== baseline run (unpatched stock modules) — ssh session ===
$ su -m nobody -c /tmp/panic_trigger
[panic_trigger] uid=65534 firing hw.dmabug.panic: kern_shutdown(dmabuf_fd, SHUT_RDWR) with dmabuf_fileops.fo_shutdown == NULL
<ssh session hangs — guest dead; vm.sh status => down>

=== serial console (vm.sh log) ===
dmabug: demo module loaded (drm.ko provides dma_buf_export/dma_buf_fd)
dmabug: mkfd: uid=65534 dmabuf=0xfffff8008d981f98 file=0xfffff8011738c900 fd=3 f_count=2 (expect 2: falloc + fd-table)
dmabug: check: dmabuf=0xfffff8008d981f98 file=0xfffff8011738c900 f_count=1 (fd closed, no other owner exists; >=1 => LEAK, 0/freed => ok)
Sep 30 05:35:06 dfbsd last message repeated 2 times
dmabug: panic: uid=65534 dmabuf fd=3 f_ops=0xffffffff82672180 fo_shutdown=0 (NULL => indirect call to 0)
dmabug: panic: calling kern_shutdown(3, SHUT_RDWR) -- same path as an unprivileged shutdown(2) on a prime fd
Fatal user address access from kernel mode from panic_trigger at 0000000000000000


Fatal trap 12: page fault while in kernel mode
cpuid = 5; lapic id = 5
fault virtual address	= 0x0
fault code		= supervisor read instruction, page not present
instruction pointer	= 0x8:0x0
stack pointer	        = 0x10:0xfffff80117f6f740
frame pointer	        = 0x10:0xfffff80117f6f758
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1312
current thread          = pri 6
kernel: type 12 trap, code=10

CPU5 stopping CPUs: 0x0000001f
 stopped
Stopped at      0:

Fatal trap 12: page fault while in kernel mode
cpuid = 5; lapic id = 5
fault virtual address	= 0x0
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff80bccb70
current process		= 1312
kernel: type 12 trap, code=0
db>
=== classification ===
ssh died + vm.sh status => down immediately after trigger  => reproduced / impact=panic