# Race hammer — dynamic oid teardown vs concurrent unprivileged readers

Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 (X86_64_GENERIC, INVARIANTS),
2 vcpu-visible ncpus, stock kernel (uname -a in env.txt).

Reader (unprivileged user `maxx`, /tmp/hammer_read.sh):
    loop until 45s elapsed:
        sysctl -aN > /dev/null
        sysctl kern.bootfile kern.clockrate hw.model > /dev/null
Result: reader loops: 4245        (/tmp/reader.log)

Teardown (root, same window):
    i=0; while [ $i -lt 12 ]; do kldload coretemp; kldunload coretemp; i=$((i+1)); done
Result: LOADLOOP-DONE

coretemp registers/unregisters a dynamic sysctl tree via sysctl_ctx
(per-core temperature nodes) on every load/unload, exercising:
  sysctl_add_oid / sysctl_register_oid_int / sysctl_ctx_entry_add
  sysctl_ctx_free (dry-run deregister + re-register + real free)
  sysctl_remove_oid_locked / sysctl_unregister_oid_int / kfree(M_SYSCTLOID)

Post-run state:
    $ vm.sh status  -> up
    $ vmstat -m | grep -i sysctl
             sysctl       0       0       0    390M    9.43K
          sysctloid   2.94K    123K       0    390M    2.99K   (fully drained)
    $ dmesg | tail -3   -> normal boot messages, no panic/backtrace

Conclusion: the pcpu SLOCK/XLOCK topology protocol held under real
load/unload contention with concurrent full-tree readers — consistent
with the structural analysis that the (dead) oid_running drain is
currently redundant, not missing-in-effect.

Hammers were also run against the EAGAIN re-dispatch loop
(userland_sysctl kern_sysctl.c:1569-1578): no in-tree handler returns
EAGAIN, so the unbounded retry loop is unreachable (grep over sys/:
only non-sysctl code paths return EAGAIN).