panic: _callout 0xfffff8008f8ed000 verifier 0xfffff8008e102168 toc 0x4141414141414141 (expected 0xfffff8008f8ed000) func 0xffffffff826a7000/0xffffffff826a7000
Debugger("panic")

Sequence (production fd.c compiled verbatim into the rig with only
symbol-visibility renames):
  fd->tohandle armed exactly as fdstate() does at fd.c:1980
      (callout_reset(&fd->tohandle, 2, fd_iotimeout, fdc))
  PRODUCTION fd_detach(dev):
      - stops toffhandle  (fd.c:1090)
      - stops motor       (fd.c:1091)
      - NEVER stops/drains tohandle
      -> returned with "tohandle STILL ARMED" (rig print)
  softc freed (detach teardown equivalent) and the chunk canary-filled
  with 0x41 (emulating freed+reused); 2 ticks later the callout
  subsystem serviced the PENDING callout whose struct now reads
  toc/c_time = 0x4141414141414141 -> INVARIANTS callout verifier panic.

Root cause: fd.c:1078-1093 fd_detach omits fd->tohandle (armed during
I/O at fd.c:1970/:1980 as the fd_iotimeout watchdog).