run.2.log - DF-2691 decisive run #2 (second fresh boot, variant with
pipe-gated p_args spray so that p_args allocations - not spray forks -
recycle the freed proc chunks)

Command:  su -l t1 -c /tmp/t1home/kqsig_uaf
Setup:    same as run 1 (kern.ps_arg_cache_limit=8192)

stdout:
[64 dangling sig-knotes attached to freed procs]
[400 p_args spray children released, argv=1251 bytes]
<guest dies; "closing kqueue..." lost in the socket buffer at panic time>

serial console (panic.2.txt):
Fatal user address access from kernel mode from kqsig_uaf at ffffffff8063c973
Fatal trap 12: page fault while in kernel mode
cpuid = 3; lapic id = 3
fault virtual address	= 0x18
current process		= 872
Stopped at      knote_remove+0x33:      movq    0x18(%rdx),%rax
db>

Same signature as run 1 on a different CPU and different fresh boot:
deterministic-enough unprivileged kernel panic via the dangling
EVFILT_SIGNAL knote.