=== (1) force-clear in 'A' (pmap_inval_smp) and 'B' (pmap_inval_smp_cmpset) ===
346:			loopdebug("A", info);
347:			/* XXX recover from possible bug */
348:			CPUMASK_ASSZERO(info->done);
495:			loopdebug("B", info);
496:			/* XXX recover from possible bug */
497:			CPUMASK_ASSZERO(info->done);
788:					/* XXX recover from possible bug */

=== (2) info->failed: writers only, no readers ===
writers (5 expected):
345:			info->failed = 1;
370:	info->failed = 0;
494:			info->failed = 1;
519:	info->failed = 0;
786:					info->failed = 1;
readers (any non-assignment use, expect 0):
  (none — confirmed dead)

=== (3) target clears done AFTER cpu_invlpg (pmap_inval_intr) ===
4:				vm_pindex_t npgs;
7:				    info->npgs > MAX_INVAL_PAGES) {
10:					for (npgs = info->npgs; npgs; --npgs) {
11:						cpu_invlpg((void *)va);
15:				ATOMIC_CPUMASK_NANDBIT(info->done, cpu);

=== (4) sibling 'C' path re-broadcasts (does NOT abandon) ===
8:					loopdebug("C", info);
9:					/* XXX recover from possible bug */
11:					ATOMIC_CPUMASK_NANDMASK(smp_smurf_mask,
13:					smp_invlpg(&smp_active_mask);

=== (5) LOOPRECOVER is unconditionally #define-d (not a kernel option) ===
68:#define LOOPRECOVER			/* enable watchdog */
78:#define LOOPRECOVER_TIMEOUT1	2	/* initial recovery */
79:#define LOOPRECOVER_TIMEOUT2	1	/* repeated recoveries */
170:		info->tsc_target = tsc + (tsc_frequency * LOOPRECOVER_TIMEOUT2);
363:	info->tsc_target = rdtsc() + (tsc_frequency * LOOPRECOVER_TIMEOUT1);
512:	info->tsc_target = rdtsc() + (tsc_frequency * LOOPRECOVER_TIMEOUT1);

=== (6) Xinvltlb fires at interrupt level (mp_machdep.c) — cannot be held off ===
976:	 * removes cpus from the mask which already have a Xinvltlb IPI
1162: * Called from Xinvltlb assembly with interrupts hard-disabled and in a
1182:	 * Xinvltlb from executing, so deal with the race which can occur
1283:		 * lfence required prior to all tests as this Xinvltlb
1325:	 * Check to see if another Xinvltlb interrupt occurred and loop up

DONE: all six static checks executed.