serial console (vm.sh log), kernel A = rebuilt from UNMODIFIED stock
source with INVARIANTS disabled (X86_64_NOINV, only config delta vs
X86_64_GENERIC: "#options INVARIANTS"), built to isolate the INVARIANTS
assertion from the structural failure.
"DragonFly 6.5-DEVELOPMENT #0: Fri Aug 28 22:25:3x UTC 2026
 root@dfbsd:/usr/obj/usr/src/sys/X86_64_NOINV"
dense same-CRC32C window fill (1104 files at +3 s, quadratic scanlhc walk)
when:

HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
HAMMER2: CONN WAS TERMINATED
panic with -1 spinlocks held
panic: insert base 0xfffff8005753e000 overlapping elements at 0 elm 0xfffff80118dcd2c0

cpuid = 5
Trace beginning at frame 0xfffff80118dcd1d0
hammer2_base_insert() at hammer2_base_insert+0x604 0xffffffff8091a8f4
hammer2_base_insert() at hammer2_base_insert+0x604 0xffffffff8091a8f4
hammer2_chain_rename_obref() at hammer2_chain_rename_obref+0x66 0xffffffff8091a966
hammer2_chain_indirect_maintenance() at hammer2_chain_indirect_maintenance+0x3d9 0xffffffff8091c2b9
hammer2_flush_core() at hammer2_flush_core+0x8bb 0xffffffff80927f8b
hammer2_flush_recurse() at hammer2_flush_recurse+0x1c7 0xffffffff809282b7
Debugger("panic")

CPU5 stopping CPUs: 0x0000001f
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbaedb9(%rip)
db>

[reviewer note] Without INVARIANTS the crit-count assertion is gone and
the real structural panic surfaces: hammer2_base_insert detects
"overlapping elements" (hammer2_chain.c:5308-5311) while the flusher
collapses an indirect block (hammer2_flush.c:1039-1042 ->
hammer2_chain_indirect_maintenance -> hammer2_chain_rename_obref).
This is an independent stock-source hammer2 bug that deterministically
blocks the 32768-entry dense fill needed by the DF-2628 deterministic
trigger.  It reproduced on BOTH the INVARIANTS stock kernel and this
no-INVARIANTS rebuild, in BOTH a continuous fill and a batched
fill with sync() pauses between 4096-file batches.