# DF-5536 — panic-time dump walk trusts kernel page-table frames: uncontrolled OOB write / double-panic in dump_add_page

## Target
sys/platform/pc64/x86_64/minidump_machdep.c (pass 2)

## Build / Run (root on the guest; dumpdev required)
See build.sh / run.sh. Modes of mddiag.ko via `sysctl debug.mddiag=<report|panic|maptest|booby>`.

booby mode plants pdp[64] = <frame>|V in an unused kernel PDP slot (nothing live is
disturbed), then panics; the crash-dump walk then processes the planted entry.

## Expected
- baseline, frame 2^46: silent bit-OR into live kernel memory (bitmap+2GB) -> nested
  panic (vm_object_hold_shared assert), no dump.
- baseline, frame 2^47: "Fatal trap 12: page fault while in kernel mode",
  fault VA == predicted &vm_page_dump[frame>>18], "supervisor write data" -> nested
  panic, guest wedged, no dump. (panic.txt)
- patched (fix.diff): walk skips the entry, "Dump complete", savecore extracts the core. (run.patched.log)

## Files
mddiag.c, fix.diff, panic.txt (2^47 fatal trap), panic.2-silent-corruption.txt (2^46),
run.log (baseline), run.patched.log (fix validation), env.txt, build.sh, run.sh