== DF-2694 fix-v2 validation (patched kernel #1, unprivileged maxx) ==

$ uname -a
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Sun Aug 30 23:56:25 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

--- mode 0 (TCP / sorecvtcp path; baseline: panic at uipc_socket.c:1852) ---
$ ./poc_race 40 3000 3000 0
DF-2694 race: rounds=40 delay=3000+3000us recvlen=524288 mode=tcp-panic
dirtying pig (3400 MB)...
pool swapped out; starting rounds
done: 40 rounds, 0 marker leaks          <-- no panic, guest stays up

--- mode 1 (AF_UNIX / generic soreceive; baseline: panic at uipc_sockbuf.c:552) ---
$ ./poc_race 60 200 500 1
DF-2694 race: rounds=60 delay=200+500us recvlen=524288 mode=unix-leak
dirtying pig (3400 MB)...
pool swapped out; starting rounds
done: 60 rounds, 0 marker leaks          <-- no panic, guest stays up

Baseline comparison (identical triggers, stock kernel #0):
  mode 0 -> panic.txt  (assertion "m" failed in sorecvtcp uipc_socket.c:1852)
  mode 1 -> panic2.txt (assertion "sb->sb_mb == m" failed in sbunlinkmbuf
                        uipc_sockbuf.c:552)

Functional sanity on the patched kernel: sshd/networking, 100+ recv/shutdown
rounds with data-integrity checks (anomaly detector silent), shutdown(RD)
still returns EOF (recv=0) to racing readers, no stalls.