DF-5664 baseline decisive run (unpatched kernel, fresh guest)
=============================================================
$ dfbsd-qemu/vm.sh run_root 'cd /root/df5664 && kldload ./usbmbuf_of.ko; echo "kldload rc=$?"'
(no output)                       <-- ssh session died: kernel panicked mid-syscall
[host] dfbsd-qemu/vm.sh status -> down
[host] dfbsd-qemu/vm.sh log 80   -> full serial console captured to panic.txt:

  login: usbmbuf_of: sizeof(struct usb_mbuf)=48
  usbmbuf_of: block_size=0x08000000 nblocks=32
  usbmbuf_of: bytes truly required = 0x100000600 (4294968832)
  usbmbuf_of: kmalloc size (truncated!) = 0x600 (1536)        <-- THE BUG
  usbmbuf_of: kmalloc_usable_size = 1536
  usbmbuf_of: queue populated with 32 mbufs (expected 32)
  usbmbuf_of: m[0]  hdr@+000000 data_ptr=base+0x600       <== OOB (exactly one-past-end)
  ...  (all 32 mbufs OOB, m[31] at base+0xf8000600) ...
  usbmbuf_of: POKE: writing 1 byte via m[31]->cur_data_ptr (wild pointer)...

  Fatal trap 12: page fault while in kernel mode
  cpuid = 2; lapic id = 2
  fault virtual address  = 0xfffff8020ebade80
  fault code              = supervisor write data, page not present
  instruction pointer     = 0x8:0xffffffff826001cb
  current process         = 1591
  kernel: type 12 trap, code=2
  CPU2 stopping CPUs: 0x0000003b
  Stopped at usbmbuf_of_modevent+0x1cb: movb $0x41,(%rax)
  db>

Observation per status table: ssh died AND vm.sh status => down right after
=> reproduced / impact=panic (privileged harness; no unprivileged trigger).