DF-5848 guest environment (verification 2026-10-26)

uname -a:
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
    root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
(stock snapshot kernel #0 = the kernel of the ORIGINAL capture,
 incidental_nfsd_panic.txt, from the DF-3072 batch)
fresh capture kernel (panic-run1.txt):
  #1: Mon Oct 26 05:30:18 UTC 2026 (DF-5847 diagnostic build; deltas vs
  stock are confined to sys/netinet6/nd6.c -- uipc_mbuf.c and
  nfs_socket.c md5-identical to stock at capture time:
    uipc_mbuf.c    stock 0c8009550937a3fd4597a1b9225543ef
    nfs_socket.c   stock 84b1b11d8894dff5f44b90337aa707ff)
fixed-kernel A/B:
  #1: Mon Oct 26 (tri-fixed: DF-5846 + DF-5847 + DF-5848), INVARIANTS

CPU/memory: QEMU/KVM, -smp 6, 4096 MB
kernel config: X86_64_GENERIC, options INVARIANTS

NFS server setup on the guest:
  /etc/exports: "/export -alldirs -network 127.0.0.1 -mask 255.255.255.255"
  rc.conf additions: rpcbind_enable="YES" mountd_enable="YES"
                     nfs_server_enable="YES" nfs_server_flags="-t -n 4"
  nfsd listening: tcp4/tcp6 *:2049 (kernel nfsd via nfssvc; 4 servers)

attack identity: local user on the guest (loopback trigger);
  network equivalent: any host that can open TCP to the nfsd port.
  No authentication, no valid RPC needed.