# captured on guest: kldload + sysctl debug.df5477=1 + dmesg tail
kldload OK
debug.df5477: 0 -> 0
DF-5477 harness loaded: sysctl debug.df5477=1 (OOB) or =2 (fault)
DF-5477A: true table extent = 2 entries (48 bytes); st_entries = 200 (lie); walk covers 4800 bytes
DF-5477A: query UUID planted at entry 199, byte offset 4776 (past true table end)
DF-5477A: FOUND entry 199 past table end -> returned kernel DMAP pointer 0xffffc5eadbeef000 (leaked to ioctl caller)