=== baseline: securelevel=-1 (no panic, silent refcount underflow) ===
$ ssh dfbsd 'cd /root/poc/DF-1051 && ./sg_securelevel_panic; echo EXIT=$?'
./sg_securelevel_panic: opened /dev/sg0 (no panic; securelevel<=1)
EXIT=0

=== raise securelevel to 2 ===
$ ssh dfbsd 'sysctl kern.securelevel=2'
kern.securelevel: -1 -> 2

=== trigger: open /dev/sg0 in securelevel=2 ===
$ ssh dfbsd 'cd /root/poc/DF-1051 && ./sg_securelevel_panic; echo EXIT=$?'
(ssh hangs at this point — kernel panic)
SSH_RC=124   (timeout)
$ ./dfbsd-qemu/vm.sh status
down

=== panic signature from dfbsd-qemu/boot.log (serial console) ===
REF CONTENT: tok=0 count=0000000000000000 owner=0xfffff8008e11d658
lwkt_reltoken: no tokens to release
panic: lwkt_reltoken: illegal release
cpuid = 1
Trace beginning at frame 0xfffff801166fb538
lwkt_reltoken() at lwkt_reltoken+0xda 0xffffffff80679efa 
lwkt_reltoken() at lwkt_reltoken+0xda 0xffffffff80679efa 
sgopen() at sgopen+0x85 0xffffffff802c80a5 
dev_dopen() at dev_dopen+0x6c 0xffffffff8062cacc 
devfs_spec_open() at devfs_spec_open+0x27d 0xffffffff809237fd 
vop_open() at vop_open() at vop_open+0x7c 0xffffffff80709fbc 
Debugger("panic")