+ PATCHED KERNEL (fix.diff applied in guest /usr/src, make nativekernel,
+ installkernel, reboot).  uname: DragonFly ... #1: Fri Oct  9 03:00:09 UTC 2026

$ su -m nobody -c /tmp/tls_noncanon; echo EXIT=$?
tls_noncanon: invoking set_tls_area(which=0, base=0x0000800000000000, size=-1, infosize=16)
returned - kernel did not trap wrmsr
EXIT=0

[baseline kernel: this syscall never returned -- Fatal trap 9 at
 set_user_TLS+0x68 wrmsr, guest dead in DDB.  patched: returns -1/EINVAL,
 guest stays up.  EXIT=0 is the PoC's own exit code.]

$ su -m nobody -c /tmp/gscheck
gs noncanon rc=-1 errno=22 (expect -1/22 EINVAL)
gs canon    rc=0   errno=22 (stale errno; rc=0 = accepted)
EXIT=0

$ vm.sh log (post-run console) -- no Fatal trap, no panic:
login: Oct  9 03:10:32 dfbsd kernel: pid 865 (tls_edge), uid 65534: exited on signal 11
[that SIGSEGV is tls_edge.c's by-design kernel-canonical-base user-mode
 probe child; expected on both baseline and patched kernels]