serial console (vm.sh log), stock INVARIANTS kernel #0
"DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC"
dense same-CRC32C window fill in progress (target 32768 entries) when:

hammer2_mount: devstr="/dev/vn1@DATA"
hammer2_mount: device="/dev/vn1" label="DATA" rdonly=0
hammer2_ondisk: "/dev/vn1" zone=0 id=0 offset=0x0000000000000000 size=0x0000000020000000
hammer2_mount: "/dev/vn1": no recovery needed
hammer2_mount: hmp=0xfffff80118820000 pmp=0xfffff80119000000
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
HAMMER2: CONN WAS TERMINATED
panic with -1 spinlocks held
panic: td_critcount is/would-go negative! 0xfffff8008e10a980 -1
cpuid = 0
Trace beginning at frame 0xfffff801191511b0
crit_panic() at crit_panic+0x2f 0xffffffff80672cff
crit_panic() at crit_panic+0x2f 0xffffffff80672cff
spin_unlock() at spin_unlock+0x49 0xffffffff8096cda9
hammer2_base_insert() at hammer2_base_insert+0x652 0xffffffff80972ae2
hammer2_chain_rename_obref() at hammer2_chain_rename_obref+0x66 0xffffffff80972b76
hammer2_chain_indirect_maintenance() at hammer2_chain_indirect_maintenance+0x411 0xffffffff80974aa1
Debugger("panic")

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

[reviewer note] INVARIANTS-only assertion (sys/sys/thread2.h:220-223 fires
crit_panic when td_critcount goes negative) catching a double spin-unlock
reached from the flusher's indirect-block collapse path.  The same fill on
a no-INVARIANTS rebuild panics with the underlying structural check
instead - see serial_panic_noinv.log.