debug.df2462.run: 0 -> 0
0
DF2462[S0] PATH_INQ: status=0x1 max_lun=2
DF2462[S0] stats handler: 'recv=111 sent=222 flags=0x00000000 pdus-alloc=0 pdus-max=0 cws=0 cmd=0 exp=0 max=0 stat=0 itt=0'
DF2462[S0] teardown clean: free_seen=1 sessions[7]=0
DF2462[S1] teardown parked after ic_lost_target (isc_sm.c:752 returned); sessions[7]=0 still set; sp=0xfffff8008971ef80 alive
DF2462[S1] PATH_INQ: status=0x8 max_lun=0
DF2462[S1] teardown completed: free_seen=1
DF2462[S2] victim parked in ic_action after sessions[] lookup (isc_cam.c:211), sp=0xfffff801179b3280
DF2462[S2] teardown state after 3s: stop_done=0 free_seen=0 reclaimed=0 sessions[7]=0
DF2462[S2] max_lun=0x2 = LIVE session value (the drain held the teardown until the victim was done -- the FIXED outcome)
DF2462[note] reclaim moved: 0xfffff801179b3280 -> 0xfffff80118491780 (continue)
DF2462[S3] victim parked inside isc_dump_stats before touching sp, sp=0xfffff8011831eb00
DF2462[S3] teardown state after 3s: stop_done=1 free_seen=0 reclaimed=0
DF2462[S3] handler exported from FREED chunk: 'recv=111 sent=222 flags=0x00000000 pdus-alloc=0 pdus-max=0 cws=0 cmd=0 exp=0 max=0 stat=0 itt=0' (error=0)
DF2462[S3] handler exported LIVE values (no freed-chunk data surfaced; on the FIXED tree this is the expected outcome: the drain held the teardown)
DF2462[note] reclaim moved: 0xfffff8011831eb00 -> 0xfffff8011854fc80 (continue)
DF2462[S4] victim parked in ic_action (SCSI_IO) holding sp=0xfffff801179b3700 via spriv_ptr0
DF2462[S4] no reclaim chunk (teardown still draining: the FIXED outcome)
DF2462[S4] victim used the LIVE session (drain held the teardown); no freed chunk exists to corrupt
DF2462[S6] teardown parked; session OIDs still registered; run unprivileged reads now, then sysctl df2462.s6done=1
DF2462[S6] teardown completed after unprivileged reads: free_seen=1
DF2462[S5] victim parked in ic_action (SCSI_IO) holding sp=0xfffff80118550100 via spriv_ptr0
DF2462[S5] victim released over FAULT reclaim; expect kernel fault in i_nqueue_csnd's TAILQ_INSERT_TAIL (write through 0xBEBEBEBE...)
DF2462[S5] victim SURVIVED (no fault; on the FIXED tree this is the expected outcome: the drain held the teardown until the victim was done)

GUEST SURVIVED S5 on the FIXED kernel (baseline: Fatal trap 12)
DF2462DBG jsd: n=7 stop_done=0 sess=0
DF2462DBG jsd: n=8 stop_done=0 sess=0
DF2462DBG gate dfhcv: val=1 want=1 iters=9
ic_action: func_code=0x901 flags=0x40 status=0x0 target=7 lun=0 retry_count=0 timeout=0
ic_action: XPT_SCSI_IO cmd=0x0
scsi_encap: ccb->sp=0xfffff80118550100