=== BASELINE: unpatched #0 kernel, HAMMER v3 -> v4 clean upgrade (success path) ===
[probe] issuing HAMMERIOC_SET_VERSION(cur=4) on /mnt/htest/testfile (fd=3)
[probe] ioctl rc=0 errno=0 (Undefined error: 0) head.error=0 head.flags=0x%x
[probe] undo-upgrade succeeded (no leak this run)
RUN_EXIT=0
guest_status=up

NOTE: The success path exercises lock acquire (hammer_ioctl.c:638-639) and
proper release (:664-665). The BUG is on the ERROR path (:651 goto failed
skips :664-665), which requires hammer_upgrade_undo_4() to return an error.
hammer_bnew() with isnew=1 calls hammer_io_new() which always returns 0,
so the failure path is unreachable under normal conditions on a valid fs.
On GENERIC (INVARIANTS ON), if the failure were triggered, the leaked
sync_lock_refs==1 trips KKASSERT(sync_lock_refs==0) in hammer_done_transaction
(hammer_transaction.c:131) => immediate kernel panic.
On production (INVARIANTS OFF), the sync_lock stays exclusively held forever
=> all subsequent HAMMER write/flush operations deadlock (20+ sync_lock
call sites in sys/vfs/hammer/).