=== DF-2447 FIX VALIDATION RUN — patched dm.ko (sha256 4c3239e9...) ===
Guest: DragonFly 6.5-DEVELOPMENT #0 (kernel image unchanged; only dm.ko swapped)
Run:   ./dm_race_uaf 8 2000   (8 racers, 2000 iterations = ~16000 concurrent remove races)

[*] DF-2447 dm_dev_remove_ioctl UAF racer
[*] racers=8 iterations=2000 dev=df2447racer
[*] hammering remove-vs-remove race; expect INVARIANTS panic /
    slab freed-object deref / double-free / lockmgr-on-freed
[*] iter 0/2000 survived so far
[*] iter 500/2000 survived so far
[*] iter 1000/2000 survived so far
[*] iter 1500/2000 survived so far
[!] exhausted 2000 iterations without a panic -- race not hit this run
RUN_EXIT=0

Guest stayed UP. boot.log empty (no panic). Contrast with baseline run.log
(unpatched): panicked within iteration 0 with "Bad link elm ... prev->next != elm"
in dm_dev_remove_ioctl -> dm_dev_remove -> list operation.

=== Earlier longer patched stress (also clean) ===
./dm_race_uaf 8 8000 -> survived 5500+ iterations (~44000 races) before the
90s timeout cut it off (RUN_EXIT=124 from `timeout`, NOT a crash). Guest up.

CONCLUSION: the fix closes the UAF. The same PoC that deterministically
panicked the unpatched dm module now completes cleanly under heavy concurrent
remove pressure on the patched dm.ko.