Instrumented-fix-kernel run (4th fix iteration): the storm still crashes the
RESTRUCTURED teardown (documented for the fix-failed record):

Fatal user address access from kernel mode from fsetown_race at ffffffff8062e7e5
Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address	= 0x8
instruction pointer	= 0x8:0xffffffff8062e7e5
...
Stopped at      funsetown_free+0x95:    movq    0x8(%rdx),%rax
db>

Preceding console diagnostics (bounded to 500 prints) show two interleaved
funsetown_free() teardowns on adjacent slab chunks with inconsistent list
heads -- the double-teardown of a recycled sigio chunk that survived the v4
fix (see VERDICT.md "Fix validation").