[*] DF-0884 harness: mode=FIXED
[*] Thread A: read(2) on VDIR at offset 0 (will block in smbfs_findnext)
[*] Thread B: read(2) on VDIR at offset 0 (will reopen -> findclose A's ctx)
[*] Thread A is now blocked inside smbfs_findnext() holding ctx (== n_dirseq)
[*]   n_dirseq=0x8005108c0 n_dirofs=2
[*] FIXED mode: Thread B is blocked on the exclusive upgrade (A still holds shared); A must finish readvdir first.
[*] Releasing Thread A so it can complete smbfs_readvdir() and only THEN drop the shared lock for B.
[*] Thread A rc=0  Thread B rc=0
[+] FIXED: at A's write instant, ctx was still owned by A (g_a_write_saw_freed=0); the exclusive upgrade serialized the two readers so B's findclose ran only after A finished
>>> FIXED: no UAF -- unconditional LK_UPGRADE before smbfs_readvdir closes the race