=== BASELINE (unmodified kernel DragonFly 6.5-DEVELOPMENT #0, snapshot with-src) ===

boot QEMU: qemu-system-x86_64 ... -device qemu-xhci,id=xhci0,p2=8,p3=8
guest:    xhci0: <XHCI (generic) USB 3.0 controller> mem 0xfebd0000-0xfebd3fff irq 11 at device 3.0 on pci0
          xhci0: 32 bytes context size, 64-bit DMA
          usbus0 on xhci0 ; ugen0.1 root hub

# kldload /root/xhcipwn/xhcipwn.ko
xhcipwn: softc=0xfffff8008dfc0000 io_hdl=0xfffff8008df7b000 io_size=0x4000 oper_off=0x40 runt_off=0x1000 door_off=0x2000
xhcipwn: sc_door_off poisoned to 0xf0000000 (= malicious DBOFF value)
xhcipwn: next doorbell ring writes at io_hdl+0xF0000000+4*slot -- OOB of 16KB BAR

# QEMU monitor: device_add usb-mouse,id=m1,bus=xhci0.0,port=3     <-- "USB device insertion"

Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address	= 0xfffff8017df7b000        [== io_hdl 0xfffff8008df7b000 + door_off 0xF0000000]
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff81d59416
stack pointer	        = 0x10:0xfffff8008e1517e0
frame pointer	        = 0x10:0xfffff8008e151870
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= Idle
kernel: type 12 trap, code=2
CPU1 stopping CPUs: 0x0000003d
Stopped at      xhci_do_command+0x216:  movl    $0,(%rdx)
db>
(panic; guest dead in DDB)

=== FIXED KERNEL (same tree + fix.diff, kernel #1 Thu Oct 1 21:45:59 UTC 2026) ===

# kldload /root/xhcipwn/xhcipwn.ko        (identical poison)
xhcipwn: softc=0xfffff8008dfc0000 io_hdl=0xfffff8008df7b000 io_size=0x4000 oper_off=0x40 runt_off=0x1000 door_off=0x2000
xhcipwn: sc_door_off poisoned to 0xf0000000 (= malicious DBOFF value)

# QEMU monitor: device_add usb-mouse,id=m1,bus=xhci0.0,port=3
ugen0.2: <Unknown> at usbus0 (disconnected)      <-- enumeration fails GRACEFULLY, no doorbell write
# guest stays up; repeated 4x device_add/device_del cycles:
# dmesg | grep -c "Fatal trap"  ->  0
# uptime -> up, load averages normal. GUEST-ALIVE