#### DF-0918 fix_run.log - patched fuse.ko no-regression test ####
## kernel: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
## fuse.ko sha256: 4d03e5093cfb9c78fb43350b745f6fa6d801ecc7ea06a8f1371ad01defee64ae
## fuse.ko loaded:
 5    1 0xffffffff82600000     d000 fuse.ko (/boot/kernel/fuse.ko)
		326 fuse

=== model-level before/after ===
--- UNFIXED model (proves the primitive) ---
RESULT: NULL-ohd PRIMITIVE reproduced deterministically.
The early-return trusted `replied` without rechecking dead;
fuse_device_clear set replied with reply.buf still NULL, so
fuse_ipc.c:275 KKASSERT(ohd) fires (panic on default GENERIC).
--- FIXED model (proves the fix closes it) ---

RESULT: FIXED model — NO NULL-deref.  dead-recheck after replied
(fix.diff) returns ENOTCONN when fuse_device_clear set replied
during teardown, so fuse_ipc_tx:275 never derefs NULL ohd.

=== live daemon on patched fuse.ko ===
fused0918 rc=124
=== daemon log ===
[daemon 1421] killer: unmount returned
[daemon 1420] child: exiting after 3665326 stat() calls
[daemon 1419]   child status=9 killer status=0
[daemon 1419] === iter 2/2 ===
[daemon 1422] child: mounted /mnt/df918; driving stat() loop
[daemon 1423] killer: unmount(/mnt/df918, MNT_FORCE) -> fuse_mount_kill -> fuse_device_clear
[daemon 1423] killer: unmount returned
[daemon 1419]   child status=9 killer status=0
[daemon 1419] DONE after 2 iters.  If guest still up, the nanosecond race did
not fire this run; primitive is proven deterministically by harness.c.
=== guest still up ===
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
 4:02AM  up 10 mins, 0 users, load averages: 0.49, 0.27, 0.12