=== DF-0142 BASELINE decisive run (unpatched #0 GENERIC, INVARIANTS ON, quotas=1) ===
Run as unprivileged user maxx (uid 1001) on /tmp (tmpfs, quota-enabled).
Trigger: ./aggressive /tmp 6 8   (6 memory hogs + 8 new-chunk vquotactl spammers)

stdout (the run; ssh died when the kernel panicked):
aggressive: 6 hogs + 8 spammers on /tmp (pid 882)
aggressive: hogs ramped, launching 8 new-chunk spammers
RC=124            <- timeout; ssh became unreachable (guest panicked)

vm.sh status => down

=== panic signature from dfbsd-qemu/boot.log (the crash proof) ===
Warning: system low on memory+swap shortage -3600 for 8 ticks!
swap_pager: out of swap space
swap_pager_getswapspace: swap full allocating 16 pages
Jul 16 ... kernel: pid 960 (aggressive), uid 1001, was killed: out of swap space
panic with 1 spinlocks held
panic: assertion "count & TOK_COUNTMASK" failed in _lwkt_reltokref at /usr/src/sys/kern/lwkt_token.c:458
cpuid = 0
Trace beginning at frame 0xfffff8011e58b468
lwkt_relalltokens() at lwkt_relalltokens+0x80 0xffffffff80679380
lwkt_relalltokens() at lwkt_relalltokens+0x80 0xffffffff80679380
panic() at panic+0xda 0xffffffff8065d56a
lwkt_switch() at lwkt_switch+0x5fc 0xffffffff806732fc      <- primary: KASSERT gd->gd_spinlocks==0 (ac_spin held)
tsleep() at tsleep+0x982 0xffffffff80680872
lockmgr_exclusive() at lockmgr_exclusive+0x1ad 0xffffffff80647cfd   <- vm_map_lock(kernel_map) in kmem_slab_alloc
Debugger("panic")
CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

Reproduced twice on the #0 baseline (also reproduced on the first M_NOWAIT
fix attempt, proving M_NOWAIT insufficient; see VERDICT.md).