=== DF-2541 fix validation ===
[baseline unpatched #0 kernel]: PoC -> kernel PANIC (Fatal trap 12, IP=0x0, NULL func ptr, Idle/netisr). See run.log/run.2.log/panic.txt.

[patched ip_mroute.ko]: source patched (mroute_token added to X_ipip_input, objdump-verified gettoken@0x14e + 4 reltoken).
  installed sha256: de5fc1309842e2ca71708262210d00e1d19b2b6d97d8c40d2e3ff9deb63b6735
  (original: 7a4a68c7b480f4c350fd5b66f774e0c2cb23014713cd8d4b29beffe8b2e211bb)
  PoC re-run on patched module: STILL PANICS (identical signature: Fatal trap 12, IP=0x0, Idle).

[conclusion]: fix_failed. The minimal token fix in X_ipip_input does NOT close the race.
  Root cause: the decapsulated multicast packet is forwarded downstream via X_ip_mforward/ip_mdq
  (sys/net/ip_mroute/ip_mroute.c:1154), which accesses viftable/numvifs WITHOUT holding mroute_token
  at entry; a concurrent del_vif/X_ip_mrouter_done bzero()s viftable under the token, so the
  forwarding path still derefs zeroed vif state -> NULL func ptr call in ip_input (Idle/netisr).
  A complete fix requires synchronizing the multicast input+forwarding paths against teardown
  (e.g. netisr drain/barrier in del_vif & X_ip_mrouter_done before bzero, or protecting the
  full X_ip_mforward/ip_mdq entry paths with mroute_token).