DF-5847 guest environment (verification 2026-10-26)

uname -a (stock baseline):
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
    root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
(same build as the two historical panic captures in the DF-3389 pack)
diagnostic kernel: #1: Mon Oct 26 05:30:18 UTC 2026 (stock + diag5847
  instrumentation: llinfo-op ring + tombstone tripwire)
fixed kernel:      #1: Mon Oct 26 (tri-fixed: DF-5846+DF-5847+DF-5848)

CPU/memory: QEMU/KVM, -smp 6, 4096 MB
kernel config: X86_64_GENERIC, options INVARIANTS
source: /usr/src md5-identical to audit tree (nd6.c stock
  44470222c093b7fb4c231c2fb32a23df)

key sysctls during runs:
  net.inet6.ip6.forwarding: 0
  net.inet6.ip6.dad_count: 1 -> 0 (harness; re-added addresses skip DAD)
  net.inet6.ip6.use_tempaddr: 0 (default; regen path inert)

attack identity:
  address cycling runs as root (SIOCAIFADDR_IN6/SIOCDIFADDR_IN6)
  flooder/stretch traffic runs as uid 1001 (maxx) - matches the
  DF-3389 threat model (racing administrative address churn)
cycler rates observed: 2.7k-3.4k full add/delete cycles per second