### DF-0994 VULNERABLE build+run
queue: bio1->bio2->bio3  queue_count=3  flags=0x14 (EOF_PENDING)
--- pass 1: bio=0xffdfd740(id=1) queue_count=3 ---
  biodone(bio 1) -> total biodone calls on this bio: 1
--- pass 2: bio=0xffdfd740(id=1) queue_count=2 ---
  !! bioq_remove: bio 1 NOT in queue (already removed: yes) -> TAILQ corruption / no-op
  biodone(bio 1) -> total biodone calls on this bio: 2  <-- DOUBLE biodone (UAF)
--- pass 3: bio=0xffdfd740(id=1) queue_count=1 ---
  !! bioq_remove: bio 1 NOT in queue (already removed: yes) -> TAILQ corruption / no-op
  biodone(bio 1) -> total biodone calls on this bio: 3  <-- DOUBLE biodone (UAF)
--- pass 4: bio=0xffdfd740(id=1) queue_count=0 ---
  !! bioq_remove: bio 1 NOT in queue (already removed: yes) -> TAILQ corruption / no-op
  biodone(bio 1) -> total biodone calls on this bio: 4  <-- DOUBLE biodone (UAF)
--- pass 5: bio=0xffdfd740(id=1) queue_count=-1 ---
  !! bioq_remove: bio 1 NOT in queue (already removed: yes) -> TAILQ corruption / no-op
  biodone(bio 1) -> total biodone calls on this bio: 5  <-- DOUBLE biodone (UAF)
--- pass 6: bio=0xffdfd740(id=1) queue_count=-2 ---
  !! bioq_remove: bio 1 NOT in queue (already removed: yes) -> TAILQ corruption / no-op
  biodone(bio 1) -> total biodone calls on this bio: 6  <-- DOUBLE biodone (UAF)
--- pass 7: bio=0xffdfd740(id=1) queue_count=-3 ---
  !! bioq_remove: bio 1 NOT in queue (already removed: yes) -> TAILQ corruption / no-op
  biodone(bio 1) -> total biodone calls on this bio: 7  <-- DOUBLE biodone (UAF)
--- pass 8: bio=0xffdfd740(id=1) queue_count=-4 ---
  !! bioq_remove: bio 1 NOT in queue (already removed: yes) -> TAILQ corruption / no-op
  biodone(bio 1) -> total biodone calls on this bio: 8  <-- DOUBLE biodone (UAF)
--- pass 9: bio=0xffdfd740(id=1) queue_count=-5 ---
  !! bioq_remove: bio 1 NOT in queue (already removed: yes) -> TAILQ corruption / no-op
  biodone(bio 1) -> total biodone calls on this bio: 9  <-- DOUBLE biodone (UAF)
--- pass 10: bio=0xffdfd740(id=1) queue_count=-6 ---
  !! bioq_remove: bio 1 NOT in queue (already removed: yes) -> TAILQ corruption / no-op
  biodone(bio 1) -> total biodone calls on this bio: 10  <-- DOUBLE biodone (UAF)
--- pass 11: bio=0xffdfd740(id=1) queue_count=-7 ---
  !! bioq_remove: bio 1 NOT in queue (already removed: yes) -> TAILQ corruption / no-op
  biodone(bio 1) -> total biodone calls on this bio: 11  <-- DOUBLE biodone (UAF)
--- pass 12: bio=0xffdfd740(id=1) queue_count=-8 ---
  !! bioq_remove: bio 1 NOT in queue (already removed: yes) -> TAILQ corruption / no-op
  biodone(bio 1) -> total biodone calls on this bio: 12  <-- DOUBLE biodone (UAF)
--- pass 13: bio=0xffdfd740(id=1) queue_count=-9 ---
  !! bioq_remove: bio 1 NOT in queue (already removed: yes) -> TAILQ corruption / no-op
  biodone(bio 1) -> total biodone calls on this bio: 13  <-- DOUBLE biodone (UAF)
--- pass 14: bio=0xffdfd740(id=1) queue_count=-10 ---
  !! bioq_remove: bio 1 NOT in queue (already removed: yes) -> TAILQ corruption / no-op
  biodone(bio 1) -> total biodone calls on this bio: 14  <-- DOUBLE biodone (UAF)
--- pass 15: bio=0xffdfd740(id=1) queue_count=-11 ---
  !! bioq_remove: bio 1 NOT in queue (already removed: yes) -> TAILQ corruption / no-op
  biodone(bio 1) -> total biodone calls on this bio: 15  <-- DOUBLE biodone (UAF)
--- pass 16: bio=0xffdfd740(id=1) queue_count=-12 ---
  !! bioq_remove: bio 1 NOT in queue (already removed: yes) -> TAILQ corruption / no-op
  biodone(bio 1) -> total biodone calls on this bio: 16  <-- DOUBLE biodone (UAF)
  (safety: >16 iters, stopping loop)

FINAL: queue_count=-13 (started 3; correct=0; <0 = underflow)
  bio1.biodone=16 bio2.biodone=0 bio3.biodone=0 (any >1 = DOUBLE biodone/UAF)
RESULT: BUG CONFIRMED — queue_count underflow and/or double biodone on stale bio (kernel: bio UAF + TAILQ corruption)
rc=1