# DF-2673 — recursive vm_map_lock panic in vm_map_growstack() under MAP_WIREFUTURE

## What

`vm_map_growstack()` upgrades to the **exclusive** map lock
(sys/vm/vm_map.c:4228-4233), inserts the stack growth, and then — if
`mlockall(MCL_FUTURE)` set `MAP_WIREFUTURE` — calls
`vm_map_user_wiring()` at sys/vm/vm_map.c:4274-4278 **while still holding
that exclusive lock**.  `vm_map_user_wiring()` immediately does
`vm_map_lock(map)` (sys/vm/vm_map.c:2594) → `lockmgr(LK_EXCLUSIVE)`
recursion without `LK_CANRECURSE` → `panic("lockmgr: locking against
myself")` (sys/kern/kern_lock.c:310).

## Impact

Privileged (mlockall requires SYSCAP_RESTRICTEDROOT) local kernel panic /
denial of service.  Every stack growth in an MCL_FUTURE process panics.

## Reproduce

```
./build.sh            # cc -O2 -o /tmp/grow_wirefuture grow_wirefuture.c
                      # RUN AS ROOT
/tmp/grow_wirefuture  # mlockall(MCL_FUTURE); fault 8MB below the stack
```

Expected (observed): guest dies in DDB with

```
panic: lockmgr: locking against myself
lockmgr_exclusive() at lockmgr_exclusive+0x3e0
lockmgr_exclusive() at lockmgr_exclusive+0x3e0
vm_map_user_wiring() at vm_map_user_wiring+0x3a
vm_map_grow_stack() at vm_map_growstack+0x399
vm_fault() at vm_fault+0x11f
trap_pfault() at trap_pfault+0x209
```

## Fix

`fix.diff` — save the grown range and perform the wiring **after** the map
lock is released (same pattern vm_mmap.c:1510-1511 already uses).