# DF-2442: dm_dev_insert KKASSERT panic via concurrent create race

## Build & Run

### Setup (as root)
```
kldload dm
cc -O2 -o poc poc.c -lprop
```

### Trigger (as root — control dev is 0640 root:operator)
```
./poc [num_children] [num_rounds]
# defaults: 8 children, 200 rounds
```

## Expected Output (unpatched #0 kernel)
Kernel panic on round 1:
```
panic: assertion "dmv != NULL" failed in dm_dev_insert at dm_dev.c:195
```
Guest dies immediately.

## Expected Output (fixed dm.ko)
```
[round   1] created=1 existed=7 other=0
[*] All 5 rounds completed without panic.
```
EEXIST returned cleanly; no KKASSERT. Guest stays up.

## Mechanism
Concurrent `create` ioctls for the same name race past the early
`dm_dev_lookup` check. The second thread to call `dm_dev_insert` finds the
name already present, enters the else-branch with `dmv==NULL` (uuid was
zero-filled, so uuid lookup was skipped), and the `KKASSERT(dmv != NULL)`
at dm_dev.c:195 fires.

## Note
Under sustained racing (50+ rounds), a secondary devstat_remove_entry NULL
deref can occur in the error cleanup path — a separate bug.