# run.2.log — DF-5648 negative-control experiment (kenv hint injection)
# Guest: DragonFly 6.5-DEVELOPMENT X86_64_GENERIC (i440fx, PIIX3 0x70008086)
# Performed BEFORE the final `vm.sh reset with-src` (guest restored afterwards).

$ cp /boot/loader.conf /boot/loader.conf.auditbak
$ printf 'hint.foo.0.at="isa"\n' >> /boot/loader.conf
$ tail -2 /boot/loader.conf
console="comconsole"
hint.foo.0.at="isa"
$ shutdown -r now
[...guest reboots...]
$ kenv | grep foo
hint.foo.0.at="isa"          # <- hint IS in the kernel environment
$ devinfo | grep -B3 -A3 foo
                             # <- NO output: no foo child anywhere
$ devinfo | grep -A2 isab
        isab1
          isa1
            vga0
--
    isab0
      isa0                  # <- phantom bus, still empty
$ sysctl -a | grep foo
                             # <- nothing

# Conclusion: kenv hints never reach the enumeration path.
# isahint_identify enumerates via resource_query_string() which walks ONLY the
# compiled-in static devtab (sys/kern/subr_bus.c:2402-2412, populated by
# resource_cfgload from config(8) ioconf at SI_BOOT1_POST, subr_bus.c:2528-2586).
# kenv values are honored only for point lookups: resource_kenv()
# (subr_bus.c:2300-2325) consulted by resource_int_value (subr_bus.c:2334).
# X86_64_GENERIC compiles in zero hints -> devtab empty -> generic `at isa`
# hint enumeration is inert on the stock kernel, so the double-enumeration
# hazard requires a hint-compiled custom kernel (admin/root configuration).
#
# Second boot (post-reboot) again showed the unit theft, i.e. the topology
# defect is deterministic across boots:
#   isab0: <ACPI Generic ISA bridge> on acpi0
#   isa0: <ISA bus> on isab0
#   isab1: <PCI-ISA bridge> at device 1.0 on pci0
#   isa1: <ISA bus> on isab1