DF-2650 decisive run — stock INVARIANTS kernel #0 (before fix validation).
Guest session (root) then unprivileged trigger; ssh session wedged when the
kernel panicked (timeout on the controlling side), serial console (vm.sh log)
captured the rest:

  # vnconfig -c vn0 /tmp/craft2650.img
  # mkdir -p /mnt/h2x
  # mount -t hammer2 /dev/vn0@testvol /mnt/h2x
  MOUNT_OK
  # cat /mnt/h2x/f1
  h2650payload
  # su -m nobody -c "/tmp/trigger /mnt/h2x/f1"
  uid=65534 euid=65534, issuing HAMMER2IOC_BULKFREE_SCAN
  <kernel panic - ssh session hung; guest down>

--- serial console (dfbsd-qemu/vm.sh log) ---
vn0: MBR magic not found; assume a COMPATIBILITY_SLICE (s0)
hammer2_mount: devstr="/dev/vn0@testvol"
hammer2_mount: device="/dev/vn0" label="testvol" rdonly=0
hammer2_ondisk: "/dev/vn0" zone=0 id=0 offset=0x0000000000000000 size=0x0000000004000000
hammer2_mount: "/dev/vn0": no recovery needed
hammer2_mount: hmp=0xfffff80118720000 pmp=0xfffff80118f00000
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
HAMMER2: CONN WAS TERMINATED
hammer2: bulkfree buf=1M
hammer2: pass 0000000000000000-0000000004000000 (all media)
hammer2_bulkfree: Scanning testvol
panic: assertion "radix != 0" failed in h2_bulkfree_callback at /usr/src/sys/vfs/hammer2/hammer2_bulkfree.c:848
cpuid = 3
Trace beginning at frame 0xfffff8011866f058
h2_bulkfree_callback() at h2_bulkfree_callback+0x2a9 0xffffffff80962b69
h2_bulkfree_callback() at h2_bulkfree_callback+0x2a9 0xffffffff80962b69
hammer2_bulkfree_scan.constprop.2() at hammer2_bulkfree_scan.constprop.2+0x121 0xffffffff80962d71
hammer2_bulkfree_scan.constprop.2() at hammer2_bulkfree_scan.constprop.2+0x418 0xffffffff80963068
hammer2_bulkfree_scan.constprop.2() at hammer2_bulkfree_scan.constprop.2+0x418 0xffffffff80963068
hammer2_bulkfree_pass() at hammer2_bulkfree_pass+0x395 0xffffffff809636e5
Debugger("panic")

CPU3 stopping CPUs: 0x00000037
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>