=== DF-0762 BASELINE RUN on UNPATCHED kernel 6.5-DEVELOPMENT #0 ===
Hammer2 image: /dev/vn0@TEST on /h2test (hammer2, 2GB), chowned to maxx.
Harness run as unprivileged user 'maxx' (uid 1001).

--- Run 1: ./h2_churn 90 4 2 2 ---
DF-0762: hammer2 churn on /h2test, duration=90s (crud=4 rename=2 tree=2 sync=1)
DF-0762: if the kernel panics in hammer2_chain_lastdrop / page-fault at a low address, the bug is reproduced.
DF-0762: churn finished without local error. Check serial console / dmesg for hammer2_chain_lastdrop panic.
RUN_EXIT=0
guest status after: up ; boot.log line delta: 0 (no panic in serial console)

--- Run 2: ./h2_churn 150 8 4 4 ---
DF-0762: hammer2 churn on /h2test, duration=150s (crud=8 rename=4 tree=4 sync=1)
DF-0762: churn finished without local error.
RUN_EXIT=0
guest status after: up ; boot.log line delta: 0

--- Run 3 (background): ./h2_churn 200 10 6 6 ---
DF-0762: hammer2 churn on /h2test, duration=200s (crud=10 rename=6 tree=6 sync=1)
DF-0762: churn finished without local error.
BG_DONE rc=0
guest status after: up ; boot.log line delta: 0

NOTE: The bug is a provable static NULL-deref (line 654 dereferences parent==NULL
in the no-parent else-branch retry path). The live trigger is a narrow
concurrent-ref-bump race on a transiently-parentless chain during topology
teardown; it did not win within ~3.5 min of aggressive multi-thread churn.
The race window is the cmpset at line 650 failing due to a concurrent
hammer2_chain_ref bumping refs 1->2 exactly at that instant. The kernel
itself acknowledges such races exist (h2race1 detection kprintf at line 403).