# DF-5374 decisive run (guest root, kernel with option targ, Oct 3 2026)
root@dfbsd# ./poc5374 w
[*] DF-5374: opening /dev/targ (clone master)
[+] opened clone fd 3; state=TARG_STATE_OPENED, softc->periph == NULL, no TARGIOCENABLE issued
[*] write(3, ccb) BEFORE enable -> expect NULL-deref panic in targwrite/cam_periph_lock NOW
(ssh session dies; serial console:)
Fatal user address access from kernel mode from poc5374 at ffffffff802c9930
Fatal trap 12: page fault while in kernel mode
fault virtual address  = 0x40
Stopped at      targwrite+0x130:        movq    0x40(%rax),%rax

# unprivileged variant (user maxx):
[*] DF-5374: opening /dev/targ (clone master)
[-] open failed: Permission denied       (clone node is 0600 root:wheel)