=== BASELINE reproduction on UNPATCHED kernel #0 ===
kern.version: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026

--- PoC run as uid 1001 (maxx) ---
[*] lo0 real group_len=32
[+] trigger ioctl (len=33) rc=-1 errno=22 (Invalid argument)
[!] child PID 942 still alive after 6 s — DEADLOCK CONFIRMED
(harness rc=124 — the PoC's own waitpid() on the D-state child blocked,
 and timeout had to tear the ssh session down at 30s)

--- Cross-session wedge proof (SEPARATE fresh ssh, ifconfig lo0) ---
$ timeout 8 ssh dfbsd-maxx 'ifconfig lo0; echo IFCONFIG_DONE'
(no output — ifconfig blocked forever in D-state on ifnet_lock())
harness rc=124 (timeout killed the ssh session after 8s)

--- Conclusion ---
ifnet_mtx is permanently held by the (returned) triggering thread.
EVERY subsequent ifnet_lock() caller blocks in uninterruptible sleep.
Network subsystem is dead. No panic, no kernel message.
Recovery: dfbsd-qemu/vm.sh reset with-src