=== DF-0745 FIXED-logic harness (transcribes fix.diff): callback does NOT free; l2cap_request_free drains ===
transcribed from sys/netbt/l2cap_misc.c (FIXED) and sys/kern/kern_timeout.c:857-930

########## SCENARIO 1: pure double-free (no slab reuse) ##########
[setup] req=0x8005008c0 on g_link=0x4036d0 (ACTIVE+armed, in hl_reqs)

zone_free() calls on req slot: 1 (expected 2)
double-free events:            0
stale TAILQ_REMOVE events:     0
>>> FIXED: no double-free (callback no longer frees; Thread B's single l2cap_request_free is the only free) <<<

########## SCENARIO 2: slab reuse between the two frees ##########
[setup] req=0x800500880 on g_link=0x4036d0 (ACTIVE+armed, in hl_reqs)
[reclaim] WARNING: zone_alloc did not return req's slot (got 0x800501100, expected 0x800500880); TAILQ-corruption demo degraded
[reclaim] slab reuse: zone_alloc returned 0x800501100 (== old req slot); now a live request on g_link2.hl_reqs (pre-callout-arm window)

zone_free() calls on req slot: 1 (expected 2)
double-free events:            0
stale TAILQ_REMOVE events:     0
g_link2.hl_reqs.tqh_first = 0x800501100 (reused req=0x800501100); still linked
>>> FIXED: no TAILQ corruption and no free-of-live-object (req not freed by callback -> not on freelist -> not reused -> no stale deref) <<<

=== SUMMARY (FIXED: success = NO corruption) ===
Scenario 1 (was double-free):          FIXED (clean)
Scenario 2 (was TAILQ/UAF corruption):  FIXED (clean)

>>> DF-0745 FIX VALIDATED: removing the free from the callback eliminates both the double-free and the TAILQ/use-after-free corruption <<<