# Audit guest environment (DF-5464/5465/5466 baseline + fix runs)

Baseline kernel (all reproduction runs):
  DragonFly dfbsd 6.5-DEVELOPMENT #0: Mon Oct 5 22:59:13 UTC 2026
      root@dfbsd:/usr/obj/usr/src/sys/X86_64_NOINV  x86_64
  = sys/config/X86_64_GENERIC with "options INVARIANTS" removed and
    ident X86_64_NOINV, built on the guest with
    `make -j6 nativekernel KERNCONF=X86_64_NOINV`.
    Stock GENERIC also ships WITHOUT INVARIANTS (sys/config/GENERIC has
    no INVARIANTS line; only X86_64_GENERIC does) -- the NOINV build
    replicates production behaviour 1:1.

INVARIANTS-kernel evidence run (run_invkernel.log):
  DragonFly dfbsd 6.5-DEVELOPMENT #0  ...  X86_64_GENERIC  (stock)

Fix-validation kernel:
  DragonFly 6.5-DEVELOPMENT, X86_64_NOINV rebuilt after applying
  fix.diff to /usr/src/sys/platform/pc64/icu/icu_abi.c
  (build completed 23:35:53 UTC; kernel.stripped 15010336 bytes).

Guest: QEMU/KVM (qemu 7.2.22), 6 vCPUs, 4GB, virtio-blk/net, ioapic +
local apic enabled, hw.ncpu=6.  qemu cmdline from dfbsd-qemu/vm.sh.
DF-5466 note: MachIntrABI_ICU.initmap() runs on every kernel
(machdep.c:2785), so the ICU ABI entry points are exercisable via
`extern struct machintr_abi MachIntrABI_ICU` from a KLD even on this
ioapic-configured guest; the ICU ABI itself is the active ABI on
LAPIC-present/IOAPIC-absent configs where nexus_alloc_msi()
(nexus.c:591-596) forwards PCI MSI to it.

Source verified identical to the audit tree:
  icu_abi.c md5 77901cbb3116740acefd23cb5564fba3 (guest = host tree)
  msi.c     md5 42b459311d887e87ce307e77bf57216b

Kernel symbol layout (nm -n /boot/kernel/kernel):
  msi_intr            (rodata) 0xffffffff80d9d800   [192 entries]
  MachIntrABI_ICU     (data)   0xffffffff8113ed40
  icu_imen            (data)   0xffffffff8113ee00
  idt_arr             (bss)    0xffffffff817aefa0   [MAXCPU][NIDT=256]
  icu_abi_msi_start   (bss)    0xffffffff81a00400
  icu_irqmaps         (bss)    0xffffffff81a00420   [64][192] x 16B

Recovery during destructive runs: panics drop to DDB (db>) over serial;
recovered via the QEMU monitor (`system_reset` on boot-mon.sock) which
reboots from disk without reverting it.  Final state: guest reset to the
clean-source snapshot (uname -i X86_64_GENERIC, loader.conf clean,
/usr/src pristine md5 77901cbb..., no modules loaded).