== DF-0587 PoC run on PATCHED single-fix kernel (6.5-DEVELOPMENT #1) ==

Patched source verified in /usr/src/sys/netproto/802_11/wlan/ieee80211_scan_sw.c:
  774:    if (ss->ss_vap == NULL || ss->ss_ops == NULL) {
  931:    if (scandone && vap != NULL) {

Kernel build: rc=0, installed /boot/kernel/kernel (sha256 fe5df37c792efe54...).
kern.version: DragonFly 6.5-DEVELOPMENT #1: Mon Jul 13 01:25:53 UTC 2026

Run command: ./race wlan0  (maxx user)

$ ifconfig wlan0
ifconfig: interface wlan0 does not exist

$ timeout 5 ./race wlan0
DF-0587 race: scan_req vs vap-destroy on wlan0 for 60s...
RUN_EXIT=124

guest status: up   (no panic)

NOTE: PoC cannot reach the bug path on this guest (no wlan vap / no WiFi HW),
so fix_status = not_testable: validated that fix.diff APPLIES and COMPILES
cleanly, and traced (statically) that the patched code closes the cited
code path. Empirical before/after is impossible without WiFi hardware.