# stock kernel (DragonFly 6.5-DEVELOPMENT #0: Thu Jun 29 14:18:01 UTC 2026, clean-install)
# dbg2 probe of the data-carrying SG_* ioctls on /dev/sg0 (run as root):
GET_VERSION_NUM: cmd=0x20002282 rc=-1 errno=14 v=0
GET_RESERVED_SIZE: rc=-1 errno=14 size=0
SG_IO(4-byte arg): rc=-1 errno=14
# full struct-layout debug probe (sizeof(sg_io_hdr)=88, cmdp off 24, dxferp off 16):
[A sane    ] dxferp=0x401260 dxfer_len=512 alloclen=0xff ... rc=-1 errno=14 status=0 masked=0 host=0 drv=0 resid=0
[B sane36  ] dxferp=0x401260 dxfer_len=512 alloclen=0x24 ... rc=-1 errno=14 status=0 masked=0 host=0 drv=0 resid=0
[C NULL/FF] dxferp=0x0 dxfer_len=512 alloclen=0xff ... rc=-1 errno=14 status=0 masked=0 host=0 drv=0 resid=0
# => even a perfectly valid SG_IO with a real user buffer fails with EFAULT:
#    sgioctl copies from ap->a_data, which for IOC_VOID commands is a KERNEL
#    stack slot (mapped_ioctl stores the user arg by value), and std_copyin
#    rejects kernel-range sources.