env.txt — DF-5655 verification environment
============================================================

Guest (host-of-vkernel) kernel (baseline, stock snapshot):
  DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

Virtualization:
  QEMU/KVM (vm.sh: -enable-kvm -m 4096 -smp 6), host CPU vendor GenuineIntel
  -> guest wrmsr executes natively; Intel raises #GP(0) on WRMSR
     FSBASE/GSBASE/KGSBASE with a non-canonical value (SDM Vol.3 17.17)
  hw.model reports "QEMU Virtual CPU version 2.5+" (guest-visible string)

Host kernel symbols (decisive for RIP attribution):
  objdump -d /boot/kernel/kernel | <set_user_TLS>:
    ffffffff80bd4c3f: mov $0xc0000100,%ecx   (MSR_FSBASE)
    ffffffff80bd4c48: wrmsr
    ffffffff80bd4c6b: mov $0xc0000102,%ecx   (MSR_KGSBASE)
    ffffffff80bd4c74: wrmsr                  <-- baseline panic RIP (set_user_TLS+0x94)

vkernel under test:
  /usr/obj/usr/src/sys/VKERNEL64/kernel.debug (built in-guest
  `make -j6 nativekernel KERNCONF=VKERNEL64`, 46714072 B stock /
  46714128 B with fix; identical rig both phases)
  NOTE: the stock VKERNEL64 platform does not link without the DF-5474
  workaround (known filed finding: vkernel64 SYSTEM_LD drops
  ${ELDFLAGS}; -Wl,--defsym,__build_id_start=0 -Wl,--defsym,__build_id_end=0
  appended to SYSTEM_LD in sys/platform/vkernel64/conf/Makefile inside the
  guest only). Unrelated to this finding; applied identically in baseline
  and fixed phases.

vkernel boot args:
  ./kernel.debug -m 512m -r /vkroot.img -n 2 -e init_path=/bin/vkinit -s

sysctls: vm.vkernel_enable=1 (set for the session)

In-vkernel root image: /vkroot.img (ufs via vn0, per vk_image.sh),
  /bin/vkinit -> /bin/sh; trigger run as in-vkernel uid/gid 65534
  (nobody) via /bin/as_nobody.

Test syscall: SYS_set_tls_area = 472, SYS_get_tls_area = 473
  (sys/sys/syscall.h)

Trigger sha256:
  1b61aff7eb928de073d85f6fd411d50a07139aa813f858093fe90d628a2c8770  vk_tls_noncanon.c
  03132f9fb053199957afebe564ebb290611ce0cc488e74578c720d2724d37d7a  as_nobody.c