# DF-5586 — PoC pack

## Build (on the DragonFly guest)

```
sh build.sh          # cc -static -O2 -o splzcrit splzcrit.c
                      # cc -static -O0 -o storm storm.c
```

## Run

### 1. Dispatch-violation model (no root needed)

```
sh run.sh            # ./splzcrit vkernel ; ./splzcrit pc64
```

Expected:

```
== vkernel mode ==
mode=vkernel victim.lo=1 victim.hi=2 callback_critcount=1 callback_torn=1
INVARIANT_BROKEN (IPI callback ran inside the critical section ...)
RC_VKERNEL=1
== pc64 mode ==
mode=pc64 victim.lo=1 victim.hi=1 callback_critcount=0 callback_torn=0
INVARIANT_OK
RC_PC64=0
```

### 2. In-vkernel fault storm (root; needs the VKERNEL64 build + image)

```
sh build_image.sh    # creates /vkroot.img with /root/storm (DF-5474
                     # link workaround must be in
                     # sys/platform/vkernel64/conf/Makefile; see
                     # findings/poc/DF-5474)
sh run_vk.sh         # boots kernel.debug -m 512m -r /vkroot.img -n 2,
                     # runs "/root/storm 500 1" on the guest console
```

Expected (console): `STORM_DONE iters=500 intdiv=500 ill=500 prot=500
map=500` + `VKERNEL_SURVIVED_IF_YOU_SEE_THIS` + `STORM_RC=0`, vkernel
`ALIVE` at the end. This is the runtime kill of the "SA_NODEFER fault
storms" lead: guest-user storms never reach exc_segfault.

## Files

- `splzcrit.c` — model reproducer (vkernel vs pc64 modes)
- `storm.c` — guest-userland fault-storm binary for the vkernel
- `build.sh` / `run.sh` — model build/run
- `build_image.sh` / `run_vk.sh` — vkernel image + boot/storm driver
- `build_and_model.log` — full build + 3× model runs (untrimmed)
- `run_vk.log` — vkernel storm console (untrimmed tail)
- `fix.diff` — guard the tail splz() (doreti-equivalent)
- `verdict.json`, `manifest.json`, `VERDICT.md`