=== DF-2776 verification: DECISIVE RUN OUTPUTS (stock kernel K1c) ===
Rig (sysctl dfh.run2776=1 on kernel worker pinned cpu0):
  id = register_int(253, ..., "df2776rec", cpu0)
  unregister_int(id, 0)            <-- real: frees rec->name + rec
  probe = kmalloc(56, M_DEVBUF)    <-- reclaims the freed rec (LIFO)
  fill cookie memory: intr=253, name=&df_token_2776 (harness .data)
  unregister_int(id, 0)            <-- STALE cookie

--- groomed run (df2776_groomed.dmesg) ---
DF2776: registered id=0xfffff8004f164418 name-field=0xfffff8004f0a33f0
DF2776: real unregister_int done; rec+name freed (stale cookie retained by caller)
DF2776: reclaim probe kmalloc(56)=0xfffff8004f164418 freed-rec=0xfffff8004f164418 reuse=YES
DF2776: calling unregister_int(stale 0xfffff8004f164418) -- kernel will deref the freed cookie at kern_intr.c:425 and :490
warning: unregister_int: int 253 handler for DF2776-STALE-COOKIE-READ-4b77d1 not found
DF2776: returned from stale unregister_int
    -> kern_intr.c:425 read intr=253 FROM FREED MEMORY; :489-490 printed %s
       from the chosen kernel address; string disclosed to console/dmesg.

--- wild run (dfh.wild2776=1; name = 0x5151515151515150) -> PANIC (panic.txt) ---
warning: unregister_int: int 253 handler for Stopped at      strlen: cmpb    $0,(%rdi)
db>
    -> kprintf died mid-%s reading the poisoned name pointer.

=== DF-2776 FIX VALIDATION (fixed kernel K3) ---
--- groomed (df2776_fixed.dmesg) ---
warning: unregister_int: int handler 0xfffff8004f164290 not found
--- wild ---
warning: unregister_int: int handler 0xfffff8004f164290 not found
DF2776: returned from stale unregister_int
STILL-ALIVE
    -> not-found path prints the pointer only; never dereferences the stale
       cookie; the previously-fatal wild pointer is never read; no panic.