=== DF-0823 trigger run on TWO-FIX PATCHED kernel ===
Kernel: DragonFly 6.5-DEVELOPMENT #1: Mon Jul  6 05:07:42 UTC 2026
sha256 (/boot/kernel/kernel) = e5fd20954de6213e02b8dddcc52a5a0d932fa4970b8a3edc8284db766a4e7670
Fix applied: TWO changes in hammer2_admin.c:
  1. xop_helper_create: guard xop_groups allocation (if NULL)
  2. xop_helper_cleanup: iterate cluster.nchains instead of pfs_nmasters

Command: /root/trigger_v2.sh  (as root)

[1] Creating images and devices...
268435456 bytes transferred in 0.406215 secs (660821262 bytes/sec)
268435456 bytes transferred in 0.414223 secs (648045103 bytes/sec)
    fsid ad704c92-78f9-11f1-96d2-010000000000
    fsid ad744080-78f9-11f1-96d2-010000000000
[2] Creating MASTER PFS on device A...
hammer2: pfs_create(testpfs): SUCCESS
[3] Mounting MASTER PFS (nchains=1)...
[4] Getting clid...
    clid=ada6b49c-78f9-11f1-96d2-010000000000
[5] Mounting device B and creating SLAVE PFS...
hammer2: pfs_create(testpfs): SUCCESS
[6] I/O to spin up XOP threads...
total 4
drwxr-xr-x  1 root  wheel  0 Jul  6 05:15 .
drwxr-xr-x  1 root  wheel  0 Jul  6 05:15 ..
[7] Unmounting device B @DATA (SLAVE chain stays)...
[8] Unmounting cluster PFS (cleanup: nchains=2, pfs_nmasters=1)...
[9] Unmounting device A @DATA...
[10] Waiting 20s for any delayed orphan...
[SUCCESS] Guest survived — no panic (FIXED kernel).
TRIGGER_EXIT=0

=== Post-trigger verification ===
Guest status: UP
Guest alive after trigger (verified 45s+ post-umount, well past the 30s tsleep interval)
Boot log: no panic, no trap, no DDB prompt

=== Result ===
BEFORE (unpatched #0):    Fatal trap 12 page fault in hammer2_primary_xops_thread+0x2d9
                          (orphan thread accessing freed xop_groups heap) — guest DOWN
AFTER  (two-fix #1):      Trigger completes cleanly, exit 0, guest stays up indefinitely.
                          Both fixes required:
                          Fix 1: guard xop_groups allocation (prevents double-alloc leak)
                          Fix 2: cleanup loop iterates nchains (stops ALL threads before kfree)

Fix closes the bug.