# DF-5777 — run transcript (BASELINE, unpatched kernel)

Rig: console switched to vidconsole via /boot/loader.conf.local + reboot,
so syscons is the kernel console (sc0 flags 0x300 at attach;
sccninit -> sc_console_unit=0 -> scinit(SC_KERNEL_CONSOLE) ->
splash_init(), syscons.c:3432 -> splash_adp set).

Guest at the time: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54
UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

$ cd /tmp/nullsplash && make
cc ... -Werror -DKLD_MODULE ... -c nullsplash.c
cc -Wl,--build-id=sha1 -nostdlib ... -o nullsplash.ko nullsplash.o

$ kldload /tmp/nullsplash/nullsplash.ko && kldstat | tail -2
 3    1 0xffffffff81d56000    8c778 xhci.ko
 4    1 0xffffffff82600000     1000 nullsplash.ko

$ dmesg | tail -1
nullsplash: decoder init, adp=0xffffffff81136880 (.splash left NULL)
   ^ immediate-path registration: splash_adp != NULL, splash_test() ran
     init, splash_new() installed nullsplash_decoder as splash_decoder.

$ sysctl hw.nullsplash_fire=1
hw.nullsplash_fire: 0
   ... ssh session never returns (killed by host-side timeout at 45 s):
   the kernel transferred control to address 0 and dropped into DDB.

VGA console at that moment (QEMU monitor screendump -> vga_panic.png,
transcribed in panic.txt):

    kernel: type 12 trap, code=10
    CPU0 stopping CPUs: 0x0000003e
     stopped
    Stopped at      0:
    Fatal trap 12: page fault while in kernel mode
    cpuid = 0; lapic id = 0
    fault virtual address   = 0x0
    fault code              = supervisor read data, page not present
    ...
    current process         = 988        <- the sysctl(8) caller
    db>

A `trace` typed at db> re-faulted on the NULL return address (see
vga_trace_2x.png). Guest remained dead until hypervisor system_reset.