[*] lo0 real group_len=32
[+] trigger ioctl (len=33) rc=-1 errno=22 (Invalid argument)
[!] child PID 851 still alive after 6 s — DEADLOCK CONFIRMED
(then the parent process became unkillable: child was in D-state
 blocked on the leaked ifnet_mtx; kill(SIGKILL)+waitpid never returned
 and the ssh session had to be torn down by the harness at 120 s)

=== follow-up proof (separate fresh ssh session, same guest, no reset) ===
ifconfig_pid=881
WEDGE=ifconfig_still_running_after_3s
(then `ifconfig lo0` blocked forever in D-state on ifnet_lock();
 the ssh session was killed by the harness at 120 s — `timeout 4`
 could not interrupt the uninterruptible sleep)

RUN_EXIT=<not returned; harness terminated ssh session at 120 s>