=== DF-2423 decisive runtime output (consolidated) ===

--- phase 1 CONTROL (baseline harness kernel, free CCB) ---
DFX2423: phase1 CONTROL: free CCB available
DFX2423: pm_read(15, EINFO) rv=0 data=ddccbbaa (expect rv=0 data=ddccbbaa)
DFX2423: read  fis: type=27 flags=8f cmd=e4 feat=20 dev=4f scnt=00 lba=00,00,00 ctl=08
DFX2423: pm_write(3, SCTL, a1b2c3d4) rv=0 (expect 0)
DFX2423: write fis: type=27 flags=8f cmd=e8 feat=02 dev=43 scnt=d4 lba=c3,b2,a1 ctl=08
DFX2423: counters get=2 cmd=2 done=2 put=2 (expect 2/2/2/2)

--- phase 2 EXHAUSTED pool + real ahci_pm_read (baseline kernel) ---
$ timeout 90 dfbsd-qemu/vm.sh run_root 'sysctl hw.dfx2423_phase=2'
RUN_RC=124   (ssh hung; vm.sh status => down immediately after)
--- serial console (full: serial.phase2.log / panic.txt) ---
DFX2423: phase2: CCB pool EXHAUSTED, calling REAL ahci_pm_read (ahci_pm.c:976) - expect NULL deref of xa->fis at offset 0
DFX2423: get_xfer: CCB pool EXHAUSTED -> NULL (models ahci.c:3675-3678)
Fatal user address access from kernel mode from sysctl at ffffffff80a800cb


Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address	= 0x0
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff80a800cb
stack pointer	        = 0x10:0xfffff801183c7748
frame pointer	        = 0x10:0xfffff801183c7768
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 838
current thread          = pri 6 
trap number		= 12
panic: page fault
cpuid = 1
Trace beginning at frame 0xfffff801183c7538
Trace beginning at frame 0xfffff801183c7538
trap_fatal() at trap_fatal+0x301 0xffffffff80bd6c61 
trap_fatal() at trap_fatal+0x301 0xffffffff80bd6c61 
dfx_pm_read() at dfx_pm_read+0x2b 0xffffffff80a800cb 

--- phase 3 EXHAUSTED pool + real ahci_pm_write (baseline kernel) ---
RUN_RC=124; vm.sh status => down
login: DFX2423: phase3: CCB pool EXHAUSTED, calling REAL ahci_pm_write (ahci_pm.c:1013) - expect NULL deref of xa->fis at offset 0
fault virtual address	= 0x0
dfx_pm_write() at dfx_pm_write+0x2c 0xffffffff80a8018c 

--- FIXED kernel (fix.diff applied, same harness): phases 1+2+3, guest stays up ---
 ->  ->  -> ALL_PHASES_RETURNED
HAMMER2: INITIATE SPANs
swap low/high-water marks set to 41940/62910
DFX2423: phase1 CONTROL: free CCB available
DFX2423: pm_read(15, EINFO) rv=0 data=ddccbbaa (expect rv=0 data=ddccbbaa)
DFX2423: read  fis: type=27 flags=8f cmd=e4 feat=20 dev=4f scnt=00 lba=00,00,00 ctl=08
DFX2423: pm_write(3, SCTL, a1b2c3d4) rv=0 (expect 0)
DFX2423: write fis: type=27 flags=8f cmd=e8 feat=02 dev=43 scnt=d4 lba=c3,b2,a1 ctl=08
DFX2423: counters get=2 cmd=2 done=2 put=2 (expect 2/2/2/2)
DFX2423: phase2: CCB pool EXHAUSTED, calling REAL ahci_pm_read (ahci_pm.c:976) - expect NULL deref of xa->fis at offset 0
DFX2423: get_xfer: CCB pool EXHAUSTED -> NULL (models ahci.c:3675-3678)
fakep0: pm_read: no ccb available
DFX2423: pm_read returned 16 - NO CRASH
DFX2423: phase3: CCB pool EXHAUSTED, calling REAL ahci_pm_write (ahci_pm.c:1013) - expect NULL deref of xa->fis at offset 0
DFX2423: get_xfer: CCB pool EXHAUSTED -> NULL (models ahci.c:3675-3678)
fakep0: pm_write: no ccb available
DFX2423: pm_write returned 16 - NO CRASH
11:37AM  up 58 secs, 0 users, load averages: 0.10, 0.04, 0.01