DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

# kldload /root/uprobe/usbutil_probe.ko
usbutil_probe loaded: sysctl hw.usutil_probe=0 (matrix) | 1 (DF-5604 race) | 2 (NULL panic)
UPROBE case0 matrix: 108 cells, 0 failures (usb_make_str_desc write discipline)

# sysctl hw.usutil_probe=1
hw.usutil_probe: 0 -> 1
UPROBE case1(control): strlen(scratch)=25 scratch=255 bytes_past_boundary=0 desc[0..25]="Generic USB interface hub" desc[255..290]=""
UPROBE case1(RACED): strlen(scratch)=1023 scratch=255 bytes_past_boundary=769 desc[0..25]="\x8d-N-N-N-N-N-N-N-N-N-N-N-" desc[255..290]="ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ"

# stress: 3 more raced runs (sysctl -q hw.usutil_probe=1)
UPROBE case1(RACED): strlen(scratch)=1023 scratch=255 bytes_past_boundary=769 desc[0..25]="\x8d-N-N-N-N-N-N-N-N-N-N-N-" desc[255..290]="ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ"   [x3 identical]

# sysctl hw.usutil_probe=2   (case 2 — deliberate NULL-string call)
UPROBE case2: calling usb_make_str_desc(buf, 64, NULL) - expect NULL-deref panic
-> guest panicked (ssh died); see panic.txt