DF-0843 race harness: transcribes unlocked ufsdirhash_recycle/lookup/free.
  mode: UNLOCKED (current kernel: no global lock)
  outcome A (UAF): lookup derefs freed dh_hash index array -> poison 0xdededede
  outcome B (panic): lookup re-reads dh_hash -> NULL (recycle nulled it) -> NULL-deref
Ran 100 race iterations; UAF(stale-ptr)=48 (48.0%)  NULL-deref=48
VERDICT: RACE REPRODUCED -- unlocked ufsdirhash_recycle/lookup lets lookup deref freed/NULL dh_hash (UAF/panic in kernel)
---
DF-0843 race harness: transcribes unlocked ufsdirhash_recycle/lookup/free.
  mode: LOCKED (models the fix: recycle exclusive, lookup shared)
  outcome A (UAF): lookup derefs freed dh_hash index array -> poison 0xdededede
  outcome B (panic): lookup re-reads dh_hash -> NULL (recycle nulled it) -> NULL-deref
Ran 100 race iterations; UAF(stale-ptr)=0 (0.0%)  NULL-deref=0
VERDICT: RACE CLOSED -- the lock serializes recycle vs lookup (fix works)