$ # host side, guest up (fresh with-src snapshot, kernel of 2026-07-02)
$ ./vm.sh run_root 'uname -a'
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
$ ./vm.sh run_root 'sysctl kern.securelevel machdep.wall_cmos_clock machdep.adjkerntz'
kern.securelevel: -1
machdep.wall_cmos_clock: 0
machdep.adjkerntz: 0

$ # --- build ---
$ ./vm.sh run_root 'cc -O -o /root/df5330 /tmp/df5330.c && echo BUILD_OK'
BUILD_OK

$ # --- decisive run (vulnerable kernel) ---
$ timeout 90 ./vm.sh run_root 'date; rm -f /root/df5330.log; ( /root/df5330 > /root/df5330.log 2>&1 & ); sleep 12; echo "--- df5330.log:"; cat /root/df5330.log; echo "--- ps:"; ps axl | head -1; ps axl | grep df5330 | grep -v grep; echo "--- date after:"; date; sync'
Fri Oct  2 22:11:56 UTC 2026
RUN_RC=124          <-- observation session itself timed out; guest wedged

$ ./vm.sh status
up                  <-- qemu still running; guest half-frozen
$ timeout 20 ssh ... dfbsd-maxx true; echo $?
0                   <-- some CPUs still limp (network interrupts alive)

$ timeout 30 ./vm.sh run_root 'cat /root/df5330.log; echo ---; ps axl | head -1; ps axl | grep df5330 | grep -v grep; echo ---; kill -9 $(pgrep df5330) 2>&1; sleep 3; ps axl | grep df5330 | grep -v grep; echo "KILL_CHECK_DONE"; date'
DF-5330: setting wall clock to tv_sec=-1 ...
---
RC=124              <-- settimeofday never returned; even ps hangs;
                        kill -9 cannot be delivered (thread spins in crit)

$ ./vm.sh run_root 'dmesg | tail -3; echo DMESG_OK'   <-- still answerable
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
swap low/high-water marks set to 41940/62910
DMESG_OK              <-- no panic, no crash dump

$ ./vm.sh log 25   <-- serial console: normal boot output only, NO panic

$ ./vm.sh reset with-src
guest still up after shutdown; leaving it     <-- guest cannot even shut down
                                             (resettodr hangs again from the
                                              shutdown eventhandler path)
qemu-img: Could not open 'disk.qcow2': Failed to get "write" lock
                                             <-- had to kill -9 the qemu pid
                                             to recover the host disk lock

CONCLUSION (baseline, vulnerable kernel):
  * df5330.log contains ONLY the "setting ..." line -> settimeofday() never
    returned (year loop at clock.c:1175 spinning in crit on cpu0 while
    masterclock_lock is held by the caller).
  * guest wedged: observation + follow-up ssh sessions time out (RC=124);
    simple echo still works on other CPUs; no panic, no dump.
  * kill -9 impossible; shutdown impossible; permanent hang.
  => status=reproduced, impact=dos