Disassembly evidence — shipped guest modules (kernel DragonFly 6.5-DEVELOPMENT
#0 Thu Jul  2 06:02:54 2026, X86_64_GENERIC; md5 of source files verified
identical to the audited tree).

(1) __drm_puts_seq_file in /boot/kernel/drm.ko — the only in-tree route that
    feeds a RUNTIME string into seq_puts() (sys/dev/drm/drm_print.c:128):

00000000000374f0 <__drm_puts_seq_file>:
   374f0:	48 8b 47 10          	mov    0x10(%rdi),%rax   ; rax = p->arg = seq_file*
   374f4:	48 89 f2             	mov    %rsi,%rdx         ; <<< str -> %rdx
   374f7:	48 8b 38             	mov    (%rax),%rdi       ; arg1 = m->buf
   374fa:	48 8b 70 08          	mov    0x8(%rax),%rsi    ; arg2 = m->size
   374fe:	31 c0                	xor    %eax,%eax         ; 0 vector regs
   37500:	e9 00 00 00 00       	jmpq   37505 <...+0x15>  ; tail-jmp ksnprintf

x86-64 SysV: ksnprintf(rdi=buf, rsi=size, rdx=fmt, ...). The caller's DATA
string is moved into %rdx — the FORMAT parameter. Machine-code proof of the
contract divergence vs Linux seq_puts(m, str) which never interprets str.

Symbol table (drm.ko): U ksnprintf, U kvsnprintf, T __drm_puts_seq_file,
T seq_printf — the shim is linked and callable; only the debugfs dispatch
that would instantiate struct seq_file is absent (CONFIG_DEBUG_FS unset).

(2) seq_printf in /boot/kernel/drm.ko (linux_printf.c:31-39) for reference —
    note ksnprintf reached with rdx=f(fmt) and a synthesized va_list; the
    va_list-forwarding ABI question itself is known finding DF-2224 and is
    NOT re-reported here.