$ ./race_destroy 12 5000   (as root, #0 unpatched kernel)
[*] DF-0725 race: 12 children x 5000 rounds on gif666
[*] Expect: kernel panic (KKASSERT 'bit is already cleared'
     at if_clone_free_unit, or UAF/free-memory access)
<<< ssh hangs at ~round 0 (timeout 60s) — guest panicked >>>
(outer_rc=124, vm.sh status => down)

--- dfbsd-qemu/boot.log (serial console) ---
vlan666: MAC address: 00:00:00:00:00:00
panic: if_clone_free_unit: bit is already cleared
cpuid = 5
Trace beginning at frame 0xfffff801186a9768
if_clone_free_unit.isra.1() at if_clone_free_unit.isra.1+0x49 0xffffffff80733f29 
if_clone_free_unit.isra.1() at if_clone_free_unit.isra.1+0x49 0xffffffff80733f29 
if_clone_destroy() at if_clone_destroy+0x7c 0xffffffff807341fc 
ifioctl() at ifioctl+0x243 0xffffffff80731d73 
mapped_ioctl() at mapped_ioctl+0x5fa 0xffffffff806a831a 
syscall2() at syscall2+0x11e 0xffffffff80bd6a0e 
Debugger("panic")
CPU5 stopping CPUs: 0x0000001f
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>