-- NOTE (provenance): this run used a direct
--   dfbsd-qemu/vm.sh run_root "sysctl kern.hcipoc=real-malformed"
-- whose output was lost when the panic killed ssh mid-call (timeout kill).
-- The decisive output is on the host-side serial console, captured verbatim
-- in panic.real-malformed.txt:
--   HCIPOC: real-malformed: REAL ng_hci_process_event, num_con_handles=255 ...
--   HCIPOC: real-malformed: entering ng_hci_process_event...
--   panic: m_copydata: length > size of mbuf chain
--   boot() called on cpu#2 / Dump complete / reboot then wedged (send_ipiq)