DF-2750 PoC environment + full result transcripts
===============================================

Guest: DragonFly dfbsd 6.5-DEVELOPMENT, QEMU/KVM, 6 vCPUs (hw.ncpu=6),
       serial console captured via dfbsd-qemu/vm.sh log.

Stock kernel (baseline):
  DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
  (INVARIANTS build, unmodified sys/kern/kern_lock.c)

Fixed kernel (validation):
  DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Aug 31 17:16:25 UTC 2026
  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
  (same tree + findings/poc/DF-2750/fix.diff applied to sys/kern/kern_lock.c,
   built with: cd /usr/src && make nativekernel KERNCONF=X86_64_GENERIC
   (1300s), installed with make installkernel, rebooted)

Module: lkmc.ko, built in-guest:
  cd /usr/src/sys/modules/lkmc && make obj && make
  MD5 (lkmc.c) = 91ebb90f4be0a1b3aab77db4bde29a49
  sha256(lkmc.c v3) = see verdict.json code_hash

---------------------------------------------------------------------------
BASELINE - stock kernel #0, harness v3, 3 x 20000 rounds (dmesg transcript)
---------------------------------------------------------------------------
lkmc: loaded (DF-2750 PoC, persistent threads)
lkmc: rounds=20000 hits=19750 healed=19750 bad_count=0000000008000000 stuck=0
lkmc: DEFECT REPRODUCED: concurrent KERNTHREAD releases drove XMASK 2->0, no wakeup, waiter slept on a free lock
lkmc: rounds=20000 hits=19756 healed=19756 bad_count=0000000008000000 stuck=0
lkmc: DEFECT REPRODUCED: concurrent KERNTHREAD releases drove XMASK 2->0, no wakeup, waiter slept on a free lock
lkmc: rounds=20000 hits=19617 healed=19617 bad_count=0000000008000000 stuck=0
lkmc: DEFECT REPRODUCED: concurrent KERNTHREAD releases drove XMASK 2->0, no wakeup, waiter slept on a free lock

Additional baseline runs with the functionally-identical v2 harness
(same staging, same barrier, same hit condition; lifecycle differences only):
lkmc: rounds=20000 hits=15857 healed=15857 bad_count=0000000008000000 stuck=0
lkmc: rounds=20000 hits=19739 healed=19739 bad_count=0000000008000000 stuck=0
lkmc: rounds=20000 hits=19647 healed=19647 bad_count=0000000008000000 stuck=0
lkmc: rounds=20000 hits=19760 healed=19760 bad_count=0000000008000000 stuck=0

Interpretation:
  * hits/rounds = fraction of races in which BOTH releasers took the blind
    multi-count decrement (each had read LKC_XMASK==2), driving the count
    2 -> 0 without any single-count case executing.
  * bad_count is always exactly 0x08000000 == LKC_EXREQ2: zero exclusive
    count, zero shared count, stranded EXREQ2, LKC_SHARED never pre-set.
  * healed == hits: in every hit the parked waiter stayed asleep on the
    now-FREE lock and completed ONLY after the driver's manual
    wakeup(&lkmc_lk) - i.e. the kernel itself issued no wakeup.
  * stuck=0: no harness bail-outs; guest stayed healthy and responsive
    through all runs (each 20000-round run completes in ~0.13s).

---------------------------------------------------------------------------
FIXED KERNEL - kernel #1 with fix.diff, 3 x 20000 rounds (dmesg transcript)
---------------------------------------------------------------------------
lkmc: loaded (DF-2750 PoC, persistent threads)
lkmc: rounds=1 hits=0 healed=0 bad_count=0000000000000000 stuck=0
lkmc: rounds=100 hits=0 healed=0 bad_count=0000000000000000 stuck=0
lkmc: rounds=20000 hits=0 healed=0 bad_count=0000000000000000 stuck=0
lkmc: rounds=20000 hits=0 healed=0 bad_count=0000000000000000 stuck=0
lkmc: rounds=20000 hits=0 healed=0 bad_count=0000000000000000 stuck=0

(plus one earlier 20000-round run with the v2 harness on the same fixed
kernel: rounds=20000 hits=0 healed=0 stuck=0)

Interpretation: with the multi-count decrement converted to a validated
fcmpset retry, the loser of the race re-reads LKC_XMASK==1 and falls into
the single-count case which performs the grant, clears EXREQ2/CANCEL,
pre-sets SHARED, and issues wakeup(lkp).  The waiter completes on its own
in 100% of 60000+ staged races.  Lost wakeup eliminated; no behavioral
change in the uncontended/single-releaser path.