[*] DF-2453 dm_target_flakey UAF in async read io path
[*] racing 8 readers against remove/recreate for 200 iterations
[*] iteration 0/200 (0 successful teardowns)
[*] iteration 50/200 (0 successful teardowns)
[*] iteration 100/200 (0 successful teardowns)
[*] iteration 150/200 (0 successful teardowns)

[*] Completed 200 iterations (0 teardowns succeeded).
[*] Race outcome: the UAF in _flakey_read_iodone dereferences
    freed tfc (stored in bio_caller_info1 with no refcount).
    On GENERIC with INVARIANTS, freed memory is poisoned with
    0xdeadc0de; the poisoned values at corrupt_buf_byte /
    drop_writes offsets skip both branches in iodone, making
    the UAF read SILENT (no crash).
[*] The bug IS real (code-confirmed): _flakey_read stores tfc
    in bio_caller_info1.ptr with NO refcount. A concurrent table
    destroy (dm_target_flakey_destroy -> kfree(tfc)) while async
    I/O is in flight produces a use-after-free at
    tfc->corrupt_buf_byte etc. in _flakey_read_iodone.
[*] Impact: latent UAF; hard to crash deterministically because
    read() is synchronous (iodone fires before read returns) and
    INVARIANTS poisoning makes freed-memory reads benign.
RUN_EXIT=0
(no panic, guest survives)