DF-5721/DF-5722 unprivileged reachability probes (run as uid 1002 "auditor")
==============================================================================
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026 x86_64
(run on the SMP socket-serial rig boot, 2026-10-10 16:22 UTC)

$ su -m auditor -c /tmp/probe_int3
int3: about to execute 0xcc in user mode
Trace/BPT trap
exit=133
-> user-mode int3 is a plain SIGTRAP (trap.c:490-495); no DDB entry.

$ su -m auditor -c /tmp/probe_step
step: initial stop stopped=1 sig=5
step: after stepping over syscall: stopped=1 sig=5
step: final stop/exitsig=5 (5=TRAP expected)
exit=0
-> PT_STEP over a `syscall` instruction (the cpu artifact) delivers
   SIGTRAP to the tracee; artifact filtered (trap.c:714-718); no DDB
   entry, machine alive.

$ su -m auditor -c /tmp/probe_dbregs
dbregs: initial stop sig=5
dbregs: SETDBREGS(kernel addr 0xffffffff80100000) = -1 errno=22 (Invalid argument)
dbregs: SETDBREGS(user addr 0x10000000) = 0 errno=0 (ok)
dbregs: after syscall-write-to-watched-buffer: stopped=1 sig=5 (watchpoint delivered to user: also fine)
dbregs: final status=0
exit=0
-> PT_SETDBREGS with DR0 = kernel text address is rejected with EINVAL
   (set_dbregs address validation, machdep.c:3190-3211). A legal
   user-space DR watchpoint whose buffer the kernel writes during
   read(2) copyout is handled by the user_dbreg_trap() filter
   (trap.c:735-742) and/or delivered to the tracee; no DDB entry,
   machine alive.

$ sysctl debug.enter_debugger=ddb    (as unprivileged "maxx")
debug.enter_debugger:
sysctl: debug.enter_debugger=ddb: Operation not permitted
-> the sysctl DDB entry door is root-gated (CTLFLAG rw, priv check;
   re-verified live).

Serial console during all probes: zero DDB markers
("Debugger(" / "db>" / "stopping CPUs").

CONCLUSION: no unprivileged path into db_stop_at_pc/db_restart_at_pc
exists on this kernel; the DDB step/continue engine's state machine is
reachable only from the (privileged) console or a panic.