=== DF-0726 fix validation on PATCHED kernel (#1, 6.5-DEVELOPMENT Mon Jul 13 15:00:47 UTC 2026) ===

Fix applied: ifnet_lock() wrapping all list/count accesses in if_clone_attach,
if_clone_detach, if_clone_list, if_clone_lookup (see fix.diff).

Functional test 1 — SIOCIFGCLONERS returns correct cloner list:
  $ /tmp/one
  rc=0 total=7
    cloner[0]=lagg
    cloner[1]=carp
    cloner[2]=lo
    cloner[3]=gif
    cloner[4]=usbus
    cloner[5]=tun
    cloner[6]=wlan
  -> reader works correctly, no regression

Functional test 2 — kldload/kldunload of all 5 cloner modules:
  loaded if_tap OK / unloaded if_tap OK
  loaded if_vlan OK / unloaded if_vlan OK
  loaded if_gre OK / unloaded if_gre OK
  loaded if_bridge OK / unloaded if_bridge OK
  loaded if_wg OK / unloaded if_wg OK
  -> module load/unload works correctly, no regression

Functional test 3 — race on patched kernel (reader2 16 threads, 60s writer 5-module cycle):
  reader: 8,541,085 total iters across 16 threads
  writer: 60s cycling if_tap/if_vlan/if_gre/if_bridge/if_wg
  result: guest UP, no panic, no new boot.log content
  reader stderr: [reader2] 8541085 total iters across 16 threads

=== Verdict ===
  fix_status: fixed
  The fix closes the race window (all four functions now hold ifnet_lock during
  list access) and introduces no functional regression. The race was code-confirmed
  but never triggered on the unpatched kernel, so the before/after behavioral
  contrast is "no panic / no panic" — but the code-path closure is verified by
  source inspection of the applied patch + successful build + boot + functional test.

Patched kernel sha256: 26ef0aa5f26f7e04d495d778a0096a9a97ace86a488cf485a8ea02d1d2ae4362