===== UNFIXED (3 runs for determinism) =====
--- run 1 ---
RESULT: USE-AFTER-FREE reproduced deterministically.
The device completion path dereferences fip after the tx timeout freed it;
this is the exact pattern the finding cites (no refcount held across the lock-drop window).
--- run 2 ---
RESULT: USE-AFTER-FREE reproduced deterministically.
The device completion path dereferences fip after the tx timeout freed it;
this is the exact pattern the finding cites (no refcount held across the lock-drop window).
--- run 3 ---
RESULT: USE-AFTER-FREE reproduced deterministically.
The device completion path dereferences fip after the tx timeout freed it;
this is the exact pattern the finding cites (no refcount held across the lock-drop window).

===== FIXED (3 runs) =====
--- run 1 ---
window (refcount_acquire under ipc_lock + fuse_ipc_put after access)
prevents the tx-waiter's timeout put from freeing fip mid-access.
This is exactly the fix in fix.diff.
--- run 2 ---
window (refcount_acquire under ipc_lock + fuse_ipc_put after access)
prevents the tx-waiter's timeout put from freeing fip mid-access.
This is exactly the fix in fix.diff.
--- run 3 ---
window (refcount_acquire under ipc_lock + fuse_ipc_put after access)
prevents the tx-waiter's timeout put from freeing fip mid-access.
This is exactly the fix in fix.diff.