--- sys/kern/vfs_mount.c	2026-06-29 12:51:19.000000000 +0000
+++ /tmp/opencode/df5788rig/sys/kern/vfs_mount.c	2026-10-12 16:31:43.069820696 +0000
@@ -400,6 +400,9 @@
 {
 	if (atomic_fetchadd_int(&mp->mnt_hold, -1) == 1) {
 		KKASSERT(mp->mnt_refs == 0);
+		/* DF5788 debug rig: poison for UAF-walk detection */
+		mp->mnt_ncmountpt.ncp = (struct namecache *)(uintptr_t)0xdf5788d0ULL;
+		mp->mnt_ncmounton.ncp = (struct namecache *)(uintptr_t)0xdf5788d1ULL;
 		kfree(mp, M_MOUNT);
 	}
 }
--- sys/kern/vfs_cache.c	2026-06-29 12:51:19.000000000 +0000
+++ /tmp/opencode/df5788rig/sys/kern/vfs_cache.c	2026-10-12 16:31:43.089820435 +0000
@@ -5081,6 +5081,10 @@
 	while (ncp && (ncp != fdp->fd_nrdir.ncp ||
 	       nch.mount != fdp->fd_nrdir.mount)
 	) {
+		/* DF5788 debug rig */
+		if (nch.mount->mnt_ncmountpt.ncp == (void *)0xdf5788d0ULL ||
+		    nch.mount->mnt_ncmounton.ncp == (void *)0xdf5788d1ULL)
+			panic("DF5788: kern_getcwd walked freed mount %p", nch.mount);
 		if (ncp->nc_flag & NCF_DESTROYED) {
 			_cache_drop(ncp);
 			ncp = NULL;
@@ -5093,6 +5097,9 @@
 		 */
 		if (ncp == nch.mount->mnt_ncmountpt.ncp) {
 			nch = nch.mount->mnt_ncmounton;
+			/* DF5788 debug rig */
+			if (nch.ncp == (void *)0xdf5788d1ULL)
+				panic("DF5788: kern_getcwd followed freed mnt_ncmounton");
 			_cache_drop(ncp);
 			ncp = nch.ncp;
 			if (ncp)