# DF-2721 runtime evidence (chronological, guest dfbsd-qemu, 6 vCPUs, 4GB)

uname: DragonFly dfbsd 6.5-DEVELOPMENT #0 X86_64_GENERIC (stock, INVARIANTS)
      for phase N; #1 (instrumented) for injector/fix-knob phases; #2
      (fix.diff verbatim + injector) for final fix validation.
ZoneSize=128KB (ZoneLimit=16384), 2048-byte chunks => 63 chunks/zone.

================================================================
[1] STOCK kernel #0 - natural cross-cpu hammer, 5 x 60s (~15.4M ops)
    producer lwkt thread pinned cpu0, consumers pinned cpu1+cpu2
    (exercises _kfree() z_CpuGd != gd remote path at ~51K ops/s/thread)
================================================================
baseline : zones128k=17 kmalloc_kva_kb=~77356 wire=145004
run 1: zones128k=17 kmalloc_entries=82 kmalloc_kva_kb=82220 map_kb=3589136 wire=146857 kalloc=3073095 kfree=3073095
run 2: zones128k=17 kmalloc_entries=82 kmalloc_kva_kb=82220 map_kb=3589168 wire=146880 kalloc=3071047 kfree=3069829
run 3: zones128k=17 kmalloc_entries=82 kmalloc_kva_kb=82220 map_kb=3589200 wire=146903 kalloc=3077190 kfree=3073669
run 4: zones128k=17 kmalloc_entries=82 kmalloc_kva_kb=82220 map_kb=3589232 wire=146925 kalloc=3071047 kfree=3069695
run 5: zones128k=20 kmalloc_entries=91 kmalloc_kva_kb=82220 map_kb=3589264 wire=146948 kalloc=3075142 kfree=3071692
=> kmalloc_kva_kb FLAT at 82220 across 15.4M ops: no natural strand
   observed in ~5 minutes (ns-scale window; see VERDICT.md).

================================================================
[2] INSTRUMENTED kernel #1 (stock protocol, counters only)
    30s natural run with debug.slab_strand_watch=1
================================================================
kern.slabstrand.census: zones128k=19 kmalloc_kva_kb=80560 ... kalloc=1538594 kfree=1536357
debug.slab_strand_hits: 0          (no completed strand)
debug.slab_strand_r0:   51948      (1 in ~30 remote frees DID read
                                    z_RSignal==0 - the precondition is
                                    common; the ns-straddle is not)

================================================================
[3] INSTRUMENTED kernel #1 + injector debug.slab_strand_inject=10us
    20s run
================================================================
kalloc=1022998 kfree=1021772, zones128k=19, kmalloc_kva_kb=80944,
hits=2 (strand-signature observations; signature has false
posititives from stale RSignal=1 on on-list zones; census flat)

================================================================
[4] INSTRUMENTED kernel #1 + injector debug.slab_strand_inject=50us
    6 x 60s campaign (campaign2.log on guest)
    BASELINE before campaign: zones128k=19 kmalloc_kva_kb=80944 wire=124471
================================================================
inj run 1: zones128k=19 kmalloc_kva_kb=164016 map_kb=3670272 wire=145525 hits=647
inj run 2: zones128k=19 kmalloc_kva_kb=249648 map_kb=3755952 wire=167017 hits=1318
inj run 3: zones128k=19 kmalloc_kva_kb=288560 map_kb=3794912 wire=176788 hits=1626
inj run 4: zones128k=19 kmalloc_kva_kb=355120 map_kb=3861520 wire=193486 hits=2142
inj run 5: zones128k=19 kmalloc_kva_kb=416688 map_kb=3923136 wire=208917 hits=2619
inj run 6: zones128k=20 kmalloc_kva_kb=417200 map_kb=3923696 wire=209087 hits=2627
post runs, drain + 20s settle:
settled   : zones128k=20 kmalloc_kva_kb=417200 map_kb=3923696 wire=209118

=> +336,256 KB (328 MB) of KMALLOC KVA and +84,647 wired pages
   (+330 MB) accumulated MONOTONICALLY and NONE of it returned after
   the workload stopped and everything settled.  Each stranded zone
   = 128KB KVA + 32 wired pages, permanently.  (zones128k undercounts
   because adjacent stranded-zone map entries merge; kmalloc_kva_kb
   and v_wire_count are merge-immune.)

================================================================
[5] INSTRUMENTED kernel #1, fix knob ON (debug.slab_strand_fix=1)
    + injector 50us, SAME 6 x 60s campaign (campaign3.log)
    BASELINE: zones128k=20 kmalloc_kva_kb=418480 wire=209465
================================================================
FIX run 1: zones128k=20 kmalloc_kva_kb=418480 wire=209465 hits=2887
FIX run 2: zones128k=21 kmalloc_kva_kb=418224 wire=209417 hits=3128
FIX run 3: zones128k=22 kmalloc_kva_kb=418096 wire=209418 hits=3369
FIX run 4: zones128k=20 kmalloc_kva_kb=417456 wire=209290 hits=3573
FIX run 5: zones128k=21 kmalloc_kva_kb=417968 wire=209418 hits=3793
FIX run 6: zones128k=19 kmalloc_kva_kb=418480 wire=209562 hits=3957
settled   : zones128k=19 kmalloc_kva_kb=418480 wire=209561

=> Same race exposure (hits rose 2887->3957, i.e. the window fired
   ~1070 more times) but ZERO net KVA/wire growth: every would-be
   strand got the post-push IPI and the zone was recovered.
   (fix knob implements exactly the decision logic of fix.diff:
   unconditional z_RCount hold across the push + post-push re-read
   of z_RSignal + IPI on the NULL->non-NULL transition.)

================================================================
[6] FIX-VERBATIM kernel #2 (fix.diff applied byte-for-byte to
    sys/kern/kern_slaballoc.c + injector/counter instrumentation
    only) + injector 50us, same campaign => see fix_validation.log
================================================================