=== BASELINE (unpatched X86_64_GENERIC 6.5-DEV #0 Thu Jul 2 06:02:54 UTC 2026) ===

variant A - attacker frame 2^46 (silent corruption):
$ sysctl debug.mddiag=booby        # plants pdp[64] = 0x0000400000000000 | V
DFRIG: booby planted: pdp[64] = 0x400000000000|V
DFRIG: dump walk will call dump_add_page(0x400000000000) unguarded -> vm_page_dump[0x10000000] = 0xfffff800c0000000
panic: DF-5536 rig: intentional panic with booby PD entry
boot() called on cpu#0
panic: assertion "obj != NULL" failed in vm_object_hold_shared at /usr/src/sys/vm/vm_object.c:330
-> guest wedged; NO dump. The wild bit-OR at vm_page_dump+2GB hit a live kernel object.

variant B - attacker frame 2^47 (direct attribution), see panic.txt:
DFRIG: booby planted: pdp[64] = 0x800000000000|V
DFRIG: dump walk will call dump_add_page(0x800000000000) unguarded -> vm_page_dump[0x20000000] = 0xfffff80140000000
panic: DF-5536 rig: intentional panic with booby PD entry
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xfffff80140000000        <- EXACTLY the predicted &vm_page_dump[frame>>18]
fault code         = supervisor write data, page not present   <- atomic_set_long in dump_add_page:459
panic: page fault
-> guest wedged; NO dump, no reset.