[BASELINE RUN on unpatched #0 kernel — 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026]
BL_BASELINE_START blk_active=0
BL invoking /tmp/trigger_race 131072 0 0 1

[=== iter 1/1 iosize=131072 nreads=0 preclose=0 ===]
[1] DIOCRECLUSTER ok
[2] wrote BLK_READ|CREATE iosize=131072
[3] closing sv_us -> reader EOF -> teardown race
[4] waiting 5s for teardown + diskiodone race...
*** SSH TIMED OUT (guest panicked during the 5s wait) ***

=== boot.log panic evidence ===
panic: assertion "pstate != NULL" failed in kdmsg_msg_alloc at /usr/src/sys/kern/kern_dmsg.c:1822
cpuid = 5
Trace beginning at frame 0xfffff8008ed4c860
kdmsg_msg_alloc() at kdmsg_msg_alloc+0x267 0xffffffff80636007 
kdmsg_msg_alloc() at kdmsg_msg_alloc+0x267 0xffffffff80636007 
diskiodone() at diskiodone+0x120 0xffffffff80694dc0 
vtblk_vq_intr() at vtblk_vq_intr+0xa7 0xffffffff80a69f37 
vtpci_msix_intr() at vtpci_msix_intr+0x32 0xffffffff80a71d42 
lwkt_serialize_handler_call() at lwkt_serialize_handler_call+0xd3 0xffffffff8067cb83 

ANALYSIS: The kdmsg_state was freed by the connection-teardown path (simulated
DELETE -> disk_blk_read error path -> kdmsg_msg_reply -> cleanuptx -> state
freed with parent set to NULL by kdmsg_subq_delete).  When the 128KB async
disk read completed, diskiodone() called kdmsg_msg_alloc(state,...) which read
state->parent == NULL on the freed state, triggering KKASSERT(pstate != NULL).
This is a confirmed use-after-free on kdmsg_state_t.