DF-5471 — actual run transcript (baseline, stock kernel, then fix.diff)
Guest: DragonFly 6.5-DEVELOPMENT, stock X86_64_GENERIC (DDB, DDB_TRACE).
Fresh boot in both phases; DDB never entered before the trigger, so
db_jmpbuf is still BSS-zero — exactly the state of the panic path, where
kern_shutdown.c:881 print_backtrace(6) runs BEFORE Debugger("panic").

=== BASELINE (crash; run twice, identical) ===

root@dfbsd# sysctl -w debug.df_kfault=1
debug.df_kfault: 0 -> 0
<ssh session hangs — guest wedged in DDB; vm.sh status => down>

Serial console (dfbsd-qemu/boot.log, full copy in panic.txt):

DFTRACE: kfault: chain=0xfffff80116c07a80, frame1=0xfffff80116c07aa0, frame1->fp=0xffffdead00000000 (unmapped kernel VA); db_jmpbuf never set this boot
Trace beginning at frame 0xfffff80116c07a80
kprintf() at kprintf 0xffffffff8069d340
kprintf() at kprintf 0xffffffff8069d340
kprintf() at kprintf 0xffffffff8069d340
Fatal user address access from kernel mode from sysctl at ffffffff80bccb70

Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address	= 0xffffdead00000008        <- db_trace.c:231 read
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff80bccb70     <- inside db_read_bytes loop
...
kernel: type 12 trap, code=0                          <- kdb_trap default case
DOUBLE FAULT

Fatal double fault
rip = 0xffffffff80bcb71f      <- inside longjmp (support.s:811 movq %rdx,0(%rsp))
rsp = 0x0                     <- restored from ZEROED jmp_buf
rbp = 0x0
cpuid = 2; lapic id = 2
panic: double fault
cpuid = 2
Trace beginning at frame 0xfffff80089605ec8          <- trace_on_panic auto-trace
dblfault_handler() at dblfault_handler+0x10c 0xffffffff80bd682c
dblfault_handler() at dblfault_handler+0x10c 0xffffffff80bd682c
Debugger("panic")
CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

(Second identical baseline crash later in the same session — the "fix
validation" phase inadvertently still ran the unpatched kernel because the
reboot command chain aborted; full narrative in VERDICT.md.)

=== PATCHED (fix.diff) ===

root@dfbsd# sysctl -w debug.df_kfault=1
debug.df_kfault: 0 -> 0
root@dfbsd# echo KFAULT-EXIT=$?; sleep 2; uptime
KFAULT-EXIT=0
 1:29AM  up 34 secs, 0 users, load averages: 0.15, 0.04, 0.01

root@dfbsd# dmesg | tail -6
DFTRACE: kfault: chain=0xfffff801174a8f40, frame1=0xfffff801174a8f60, frame1->fp=0xffffdead00000000 (unmapped kernel VA); db_jmpbuf never set this boot
Trace beginning at frame 0xfffff801174a8f40
kprintf() at kprintf 0xffffffff8069d340
kprintf() at kprintf 0xffffffff8069d340
DFTRACE: kfault: walk returned without crashing
root@dfbsd# dmesg | grep -c "Fatal\|DOUBLE FAULT\|panic"
0

=> walk prints the two valid frames, refuses the non-forward/unmapped
   adoption, returns; guest stays up. Baseline double-fault cascade gone.