# DF-5774 — `-n :` / `-n ''` makes strtok() return NULL and strtol(NULL) kills the vkernel before boot

**File:** `sys/platform/vkernel64/platform/init.c`
**Lines:** 394-395
**Severity:** Low (operator-input NULL-deref DoS of the vkernel process at option parsing)
**Status:** reproduced (stock) / fix validated.

## Reproduce (guest, root, VKERNEL64 built)

```
cd /usr/obj/usr/src/sys/VKERNEL64
ktrace -i -f /tmp/vk5774.ktrace ./kernel.debug -m 512m -n : ; echo monitor rc=$?
kdump -f /tmp/vk5774.ktrace | grep PSIG
```

## Expected output

Vulnerable (baseline_run.log / baseline.kdump.txt):

```
monitor rc=0
kernel.debug PSIG  SIGSEGV SIG_DFL      <- vkernel child dies in strtol(NULL)
(no boot output at all)
```

Control `-n 2` parses fine and the boot proceeds
(`Using anonymous memory (512 MB)`).

Fixed (fixed_run.log, rebuilt kernel with fix.diff hunk 2):

```
-- kdump signals:
kernel.debug CALL  exit(0x40)           <- EX_USAGE, no signal
-- output was:
Bad -n option
```

## Root cause

init.c:394 `tok = strtok(optarg, ":");` returns NULL when the whole `-n`
argument is delimiters or empty (`-n :`, `-n ''`, `-n ::`), and
init.c:395 passes it straight to `strtol(tok, NULL, 0)` — a NULL `nptr`
dereference in libc. The child segfaults during getopt, the monitor sees
a signaled child (WEXITSTATUS of the wait status is 0) and exits 0 with
zero diagnostics.

## Fix

`fix.diff` hunk 2: NULL-check `tok` and `usage_err("Bad -n option")`.