DF-2679 baseline run 1 (stock kernel, fresh boot)

Setup:
  # ps -ax -o pid,uid,command | grep "[w]alker"
  42646  1002  /tmp/df2679/walker
  42647  1002  /tmp/df2679/walker
  42648  1002  /tmp/df2679/walker
  42649  1002  /tmp/df2679/walker
  (4 unprivileged walkers as uid 1002 "testu"; root churn loop cycling
   kldload/kldunload of dfrace.ko: 512 devices attach+detach+delete+poison
   per cycle, ~37k device operations/sec)

Walker progress shortly before the crash (from /tmp/df2679/walker.log):
  walker: iters=284672 fetches=31313920 maxidx=110 gen=17338
  (sanity phase, before churn started; churn then pushed generation to
   ~11.3M within ~150s)

Result (serial console, see panic.txt):
  Fatal trap 9: general protection fault while in kernel mode
  cpuid = 5; lapic id = 5
  instruction pointer     = 0x8:0xffffffff8068c065
  stack pointer           = 0x10:0xfffff801183cf5f8
  frame pointer           = 0x10:0xfffff801183cf798
  processor eflags        = interrupt enabled, resume, IOPL = 0
  current process         = 42646          <-- uid-1002 walker (see ps above)
  kernel: type 9 trap, code=0

  CPU5 stopping CPUs: 0x0000001f
   stopped
  Stopped at      sysctl_devices.part.15+0x35:    movq    0x18(%rbx),%rbx

Interpretation:
  sysctl_devices() loaded a device_t from the bus_data_devices TAILQ that
  device_delete_child() had just unlinked and kfree'd; the chunk was
  back-filled with 0xAA by the churn module, so the field load at
  0x18(%rbx) produced a non-canonical pointer -> #GP. The faulting
  process is the unprivileged walker; the free side was the privileged
  churn. Fatal trap, system down at db>.