=== DF-2777 verification: DECISIVE RUN OUTPUTS ===
Kernel K2 = stock kern_intr.c + two dormant df2777_hook call points
(src/kern_intr.hooks_stock.diffside.c):
  hook(2) right after `if (emergency_intr_thread[cpuid] == NULL) {`   (:309)
  hook(1) right after `info->i_state = ISTATE_NORMAL;`                (:327)
When armed, hook(1) stalls the first registrant between publishing
ISTATE_NORMAL and creating i_thread (the M_INTWAIT kmalloc + lwkt_create
window); hook(2) stalls the first creator of the emergency thread.
Dormant otherwise (dfh.hooks2777 readable; scenarios via sysctl dfh.run2777).

--- SC1: two concurrent register_int(intr=254, INTR_CLOCK, cpu2) ---
STOCK: Fatal trap 12: page fault while in kernel mode
       cpuid = 2; fault virtual address = 0xd8
       fault code = supervisor write data, page not present
       Stopped at register_int+0x1b9: lock orl $0x20000000,0xd8(%rdx)
       -> atomic_set_int(&info->i_thread->td_flags, TDF_CLKTHREAD)
          (kern_intr.c:349) with info->i_thread == NULL (0xd8 = offsetof
          td_flags; 0x20000000 = TDF_CLKTHREAD)
FIXED: DF2777-SC1: r1=0xfffff8008daa43e0 r2=0xfffff8008daa43a8 -- survived, no NULL-deref

--- SC2: register_int leaves ISTATE_NORMAL+NULL i_thread; interrupt arrives ---
       (harness calls sched_ithd_soft(255) with rec linked, thread uncreated)
STOCK: DF2777-SC2: calling sched_ithd_soft(255) while i_state=NORMAL/i_thread=NULL
       Fatal trap 12 ... fault virtual address = 0xb8 (supervisor READ)
       Stopped at sched_ithd_intern+0x1f: movq 0xb8(%rdx),%r8
       -> info->i_thread->td_gd (kern_intr.c:589) with NULL i_thread
FIXED: sched_ithd: stray interrupt 255 on cpu3
       DF2777-SC2: r1=... r2=... -- survived   (rate-limited stray report)

--- SC3: emergency-thread window reopened on cpu2 (rig dfh_reset_emergency),
       two concurrent first-registrations both enter the check-then-create ---
STOCK: Fatal trap 12 ... fault virtual address = 0x0
       current thread = pri 12 (CRIT)
       Stopped at systimer_add+0x15c: movq (%rcx),%rsi
       -> second concurrent systimer_init_periodic_nq re-initialized an
          already-armed emergency_intr_timer[cpu] and crashed inside
          systimer_add (kern_systimer.c) -- the double-arm defect
FIXED: DF2777-SC3: r1=0xfffff8008daa4530 r2=0xfffff8008daa4568 -- survived, no double-arm