DF-5806 — BASELINE RUN LOG (stock kernel, guest DragonFly 6.5-DEVELOPMENT
#0: Thu Jul 2 06:02:54 UTC 2026, 6 vCPU, fresh `vm.sh reset with-src` boots)

Provenance note: full untrimmed excerpts of the three decisive baseline
runs, copied verbatim from the audit session transcript (the guest wedged
so hard that on-guest logging was impossible; serial console was truncated
by the subsequent qemu restart, see VERDICT.md note).

=====================================================================
RUN 1 — 1 spinner (variant 0: SOCK_STREAM + SCM_RIGHTS control-only)
=====================================================================
build (guest, as maxx):
  $ cc -O2 -Wall -o peekspin peekspin.c
  BUILD-OK                                    <- findings/poc/DF-5806/build.log

launch + observation:
  $ ./peekspin 0 1 && echo parent-ok
  spawned 1 spinner(s), variant 0
  parent-ok
  (3 s later)
  --- ps #1 ---
  >>> command produced NO output for 120 s and was killed by the harness
  (shell tool terminated command after exceeding timeout 120000 ms)

subsequent probes:
  $ timeout 90 vm.sh run_root 'ps axo pid,stat,time,cpu,comm | grep peekspin; echo PS1-DONE'
  PS1-TIMEOUT rc=255
  $ timeout 100 vm.sh run_root 'echo ALIVE; ...'
  Connection timed out during banner exchange
  SSH-FAILED rc=255
  $ vm.sh status
  down                        <- ssh probe fails; qemu process still running

Interpretation: TCP connect to :22 completes (qemu slirp forwards, guest
netisr answers), but sshd never runs -> no banner -> userland starved.

=====================================================================
RUN 2 — 1 spinner, root realtime observer pre-positioned
=====================================================================
observer (root, rtprio 0, writing to /dev/console):
  === DF-5806 OBSERVER START Mon Oct 12 23:55:49 UTC 2026 ===
  --- snapshot 0 ---
  --- snapshot 1 ---
  --- snapshot 2 ---
  --- snapshot 3 ---
  (observer FROZE here — no further snapshots, no kill-9 stage output)
  (serial console excerpt; file later truncated by qemu restart)

launch (as maxx): spawned 1 spinner(s), variant 0 — spinner-launched
subsequent ssh: "Connection timed out during banner exchange" (rc=255),
then every later command timed out; harness killed the session at 120 s.

Interpretation: even a REAL-TIME root observer stops running once the
wedge takes hold; guest never recovers until forced qemu kill +
snapshot revert.

=====================================================================
RUN 3 — 1 spinner, timed ssh probes (fresh with-src boot)
=====================================================================
  00:03:07  spawned 1 spinner(s), variant 0
  >>> the launching ssh session itself could not finish draining output;
  harness killed the session at 180 s; no probe ever succeeded again.

=====================================================================
BASELINE CONCLUSION
=====================================================================
Three consecutive runs: a single unprivileged process (uid 1000)
executing recv(MSG_PEEK) on a control-only AF_UNIX SOCK_STREAM record
permanently wedges the whole guest within seconds. No panic, no
recovery; VM must be power-cycled. status=reproduced, impact=dos.