DF-2466 PATCHED-MODULE run (ahs_len=7 ds_len=1, 8000 iters, fixed iscsi_initiator.ko
sha256=977b62dc...):
  kldstat: 325 1 iscsi_initiator
  ISCSISEND: Invalid argument   (x8000 -- the ahs_len%4 guard rejects ahs_len=7)
  iter 0 ok=0 fail=1
  iter 1000 ok=0 fail=1001
  ...
  iter 7000 ok=0 fail=7001
  df2466: done iter=8000 ok=0 fail=8000 (if we got here, no panic yet)
  PATCHED_RC=124   (timeout killing the lingering forked listener child; loop done)
  --- guest up? ---
  10:11AM up 1 min, 0 users, load averages: 0.77, 0.23, 0.09
  # NO PANIC. Guest healthy. Fix closes the overflow.

=== Baseline (stock iscsi_initiator.ko sha256=99e1710b..., unpatched #0 kernel) ===
  Run #1: panic: overflowed mbuf 0xfffff80117665a00
          m_free() -> m_freem() -> sbdrop() -> tcp_input() -> Debugger("panic")
  Run #2 (fresh reset): panic: overflowed mbuf 0xfffff80117e0a000
  Run #3 (fresh reset): panic: overflowed mbuf 0xfffff80117d02800
  # Reproduced deterministically. i_send 3-byte overflow past kmalloc-8 chunk
  # corrupts adjacent slab memory (mbuf); m_free INVARIANTS check fires.