DF-2679 baseline run 2 (stock kernel, fresh boot after reset, upgraded
churn module that attaches/detaches real devices)

Setup identical to run 1 (4 walkers as testu uid 1002, root churn loop).

  # ps -ax -o pid,uid,command | grep "[w]alker"
  2169  1002  /tmp/df2679/walker
  2170  1002  /tmp/df2679/walker
  2171  1002  /tmp/df2679/walker
  2172  1002  /tmp/df2679/walker
  # tail -1 /tmp/df2679/walker2.log
  walker: generation 144077

Result (serial console tail):
  dfrace295: detached
  ...
  dfrace300: detached
  send_ipiq 5->0 tgt not draining (1)
  send_ipiq 5->0 tgt not draining (2)
  ...
  send_ipiq 5->0 tgt not draining (24) sniff=0xffffffff8067dee2,0xfffff80118db1428

Interpretation:
  Same UAF, different manifest: the poisoned devlink formed a cycle, so
  the walker thread on CPU0 never finished the TAILQ_FOREACH inside
  sysctl_devices() and never drained inter-processor interrupts; CPU5's
  IPI requests time out forever. Guest became unusable: ssh stopped
  answering (banner timeouts), ps -ax hung, clean shutdown timed out;
  force-killed from the host and snapshot-reverted.