=== DF-0585 BASELINE — unpatched #0 kernel + original if_tap.ko (Jun 29) ===
kern.version: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
/boot/kernel/if_tap.ko: 262320 bytes, Jun 29 14:24  (unpatched)
if_tap.ko sha256: 8e1a6da38502efe3cc7db2e6bb07555d555312bb02c4d5d44436b68791c65393

Trigger ./leak_tap_lock /dev/tap (improved detection: waitpid WNOHANG):
[*] opened /dev/tap (fd=3)
[*] cloned interface: tap0
[*] TAPSIFINFO returned -1: errno=41 (Protocol wrong type for socket)  [EPROTOTYPE=41]
[*] tapioctl() early-returned at if_tap.c:745 WITHOUT releasing
[*] the ifnet serializer acquired at if_tap.c:738 -> LOCK ORPHANED
[*] parent dropped its fd; child 858 will perform the final close()
[+] ===================================== PROOF =====
[+] child pid 858 still running 3s into its close() call
[+] -> tapclose() is wedged at ifnet_serialize_all() (if_tap.c:426)
[+] -> DF-0585 REPRODUCED: interface permanently wedged

Decisive kernel-side state (the smoking gun):
  858  D1  slize  leak_tap_lock      <- child wedged in uninterruptible sleep
                                         on the orphaned ifnet serializer

Corroboration — independent detached `ifconfig tap0`:
  Wedged in D-sleep on the same serializer (wchan=slize); the foreground
  `ifconfig tap0` invocation hung indefinitely (did not return within 120s).
  This proves the ENTIRE tap0 interface is wedged, not just the triggering fd.

==> BASELINE: bug reproduced. Recovery requires reboot.