=== DF-0585 BASELINE (unpatched #0) — wedge confirmed ===
kern.version: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026

Step 1 — trigger (./leak_tap_lock /dev/tap):
[*] opened /dev/tap (fd=3)
[*] cloned interface: tap0
[*] TAPSIFINFO returned -1: errno=41 (Protocol wrong type for socket)  [EPROTOTYPE=41]
[*] tapioctl() early-returned at if_tap.c:745 WITHOUT releasing
[*] the ifnet serializer acquired at if_tap.c:738 -> LOCK ORPHANED
[*] parent dropped its fd; child 908 will perform the final close()
[+] child pid 908 still alive 3s after its close() call
[+] -> tapclose() is wedged at ifnet_serialize_all() (if_tap.c:426)

Step 2 — independent ifconfig tap0 (detached, no shared fd):
  908 D3   0:00.00 ./leak_tap_lock /dev/tap          (wedged in tapclose)
  959 D1   slize    ifconfig tap0                    (wedged on orphaned serializer)
  957 S0   wait     sh -c ifconfig tap0 ...           (wrapper waiting)

==> ifconfig tap0 from an INDEPENDENT process is in D-sleep with wchan=slize
    (the lwkt serializer). The ENTIRE tap0 interface is wedged, not just the
    triggering fd. Recovery requires reboot.