=== DF-2775 verification: DECISIVE RUN OUTPUTS (stock harness kernel K1c) ===
Guest: DragonFly 6.5-DEVELOPMENT X86_64_GENERIC, INVARIANTS, 6 cpus (see env.txt)
Kernel: stock kern_intr.c + kern/df_harness.c compiled in (see src/, build.log.gz)

--- [1] Deterministic rig, groomed target = harness token (sysctl dfh.run2775=2) ---
dfh: workers up; tokens: 2775=0xffffffff81135000 2776=0xffffffff81134fe0 version=0xffffffff811473a0
DF2775-RIG: walker entry (len=63): 'dfh0/dfh1/dfh2/dfh3/dfh4/dfh5/dfh6/dfh7/DF2775-SECRET-LEAK-TOKE'
DF2775-RIG: reclaimed=1 miss=0 token-in-output=0
    [token-in-output=0 is a harness substring-check artifact: the entry is
     truncated by the stock 64-byte buf; the token is visibly present]

--- [2] Deterministic rig, groomed target = kernel version string (target2775=1) ---
DF2775-RIG: walker entry (len=63): 'dfh0/dfh1/dfh2/dfh3/dfh4/dfh5/dfh6/dfh7/DragonFly 6.5-DEVELOPME'
DF2775-RIG: reclaimed=2 miss=1 token-in-output=1
    -> rec->name was repointed at &version (0xffffffff811473a0): arbitrary
       kernel-address string read through the freed intrec.

--- [3] Fixed-walk A/B illustration on stock kernel (walkfix2775=1) ---
DF2775-RIG-FIXEDWALK: walker entry (len=63): 'dfh0/dfh1/dfh2/dfh3/dfh4/dfh5/dfh6/dfh7/dfh8/dfh9/dfh10/dfh11/d'
DF2775-RIG-FIXEDWALK: reclaimed=1 miss=0 token-in-output=0
    -> same deed against a migrate+crit snapshot walk: no freed deref.

--- [4] ORGANIC race, real `sysctl hw.intrnames`, UNPRIVILEGED reader (uid 1001,
       pinned cpu0 via pin_drop), churn thread on cpu1 doing the interposed
       unregister (unlink -> kfree -> immediate same-cpu kmalloc reclaim, 100%):
       FOUR independent kernel panics, identical signature (panic.txt +
       logs/boot.after4thpanic.log):
Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; lapic id = 0
instruction pointer = 0x8:0xffffffff809d7830
current process = 931 / 817 / 860 / 866
Stopped at      strlen: cmpb    $0,(%rdi)
    -> strlen is called from ksnprintf("%s", rec->name) in sysctl_intrnames
       (kern_intr.c:1107-1108) on the READER's cpu; rec was freed by the
       concurrent unregister. Churn rates at crash time: ~200k unlinks/s
       (dfh.unlinks2775), reader ~1900 reads/s (logs/hits.log t=1s line).

--- [5] ORGANIC token-in-reader-output: 0 hits before each panic ---
    Mechanically explained: in the stock loop the distance between loading a
    rec pointer (rec = rec->next) and dereferencing rec->name (inside the
    ksnprintf argument evaluation) is a few instructions (~5ns). A content-
    controlled (groomed) read requires the reader to be preempted exactly
    inside that window; without preemption the organic outcomes are
    benign (reads the still-valid rec) or crash (reads the freed/slab-
    metadata block), which is what the 4 panics show. The deterministic
    rig [1][2] proves the content-controlled primitive when the window is
    widened by any preemption.

--- [6] BASELINE (no churn): reader 3-30s runs, 0 anomalies (logs/reader_p2.log,
       hits.log t=1s line: reads=1927 hits=0 pre-churn) ---

=== DF-2775 FIX VALIDATION (fixed kernel K3: pristine + fix.diff + hooks) ===
--- [7] same organic PoC (reader 90s cpu0-pinned uid 1001; churn 85s, 17,408,000
       deeds, 100% reclaim, ~205k/s -- same rate as stock) ---
t=87s reads=109280 hits=0
t=88s reads=110454 hits=0
t=89s reads=111770 hits=0
SUMMARY reads=113091 hits=0 secs=90
    -> NO panic, NO anomalies (stock: panicked within seconds, 4/4 runs)
--- [8] fully-real mode-0 churn (real register_int/unregister_int storm),
       reader 45s: SUMMARY reads=5829 hits=0, no panic (9.2M iterations) ---
--- [9] fixed sysctl output still correct (src/chk.c):
rc=0 bytes=10218 entries=1536 e508=[dfp0/dfp1/dfp2/dfp3]