=== FIX-VALIDATION run on SINGLE-FIX kernel #1 ===
kern.version: DragonFly 6.5-DEVELOPMENT #1: Thu Jul  2 11:55:04 UTC 2026
kernel.stripped sha256: df6d8ac67c5eca4dd62381aa9281bce44ce45570fa58dfd1247f1839188de8b7
(bare /boot/kernel/kernel overwritten with the freshly-stripped build)

build: cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC  => NK_DONE rc=0 (full log in fix_build.log, 35329 lines)

--- PoC run #1 (as uid 1001 maxx) ---
[*] lo0 real group_len=32
[+] trigger ioctl (len=33) rc=-1 errno=22 (Invalid argument)
[*] child exited normally (code=1) — second ioctl returned, NO deadlock
RESULT: NO_DEADLOCK
RUN_EXIT=1
harness rc=0 (PoC exited cleanly; NOT 124)

--- PoC run #2 ---
[*] lo0 real group_len=32
[+] trigger ioctl (len=33) rc=-1 errno=22 (Invalid argument)
RESULT: NO_DEADLOCK
[*] child exited normally (code=1) — second ioctl returned, NO deadlock
RUN_EXIT=1
harness rc=0

--- PoC run #3 ---
[*] lo0 real group_len=32
[+] trigger ioctl (len=33) rc=-1 errno=22 (Invalid argument)
RESULT: NO_DEADLOCK
RUN_EXIT=1
[*] child exited normally (code=1) — second ioctl returned, NO deadlock
harness rc=0

--- Follow-up network ops from a SEPARATE fresh ssh (after 3 PoC runs) ---
IFCONFIG_DONE rc=0    (returned immediately — was permanently hung on #0)
ROUTE_DONE rc=0       (route -n get 127.0.0.1 returned immediately)
harness rc=0

=== BEFORE / AFTER contrast ===
BEFORE (#0 unpatched): trigger EINVAL -> ifnet_mtx leaked -> forked child
  blocks >6s (DEADLOCK_CONFIRMED) -> fresh-ssh `ifconfig lo0` hangs >=8s
  (rc=124) -> entire network subsystem dead, reboot-only recovery.
AFTER  (#1 single-fix): same trigger EINVAL, but ifnet_unlock() now runs
  on the error path -> child exits normally (code=1, alarm never fired) ->
  RESULT: NO_DEADLOCK -> fresh-ssh `ifconfig lo0` + `route get` return
  promptly. Lock is correctly released. Fix CONFIRMED.