DF-2782 run.log — decisive run on STOCK kernel (2026-09-01 04:4x UTC)

$ cc -O2 -pthread -o /tmp/limit_race /tmp/limit_race.c
$ /tmp/limit_race 300
DF-2782: 8 threads racing the mq_open limit (expect kernel panic at the :577 EMFILE path)
Connection to 127.0.0.1 closed by remote host.
(ssh dropped: kernel panicked mid-run; vm.sh status => down)

Serial console (full text: panic.txt):
	Fatal trap 12: page fault while in kernel mode
	current process = 842
	kernel: type 12 trap, code=0
	Stopped at      lockmgr_release+0x11:  movq 0x8(%rdi),%rsi
	db>

lockmgr_release dereferencing ~&((struct mqueue *)NULL)->mq_mtx — exactly
the :577-EMFILE-goto-exit-with-mq==NULL path the PoC targets.

Corroboration: the identical signature was observed (inadvertently but
conclusively) when a first-version DF-2781 fix diff placed a check that
'goto exit's with mq == NULL — same trap, same instruction
(fixiter1_context.txt). That incident is what pinpointed the latent stock
bug: the pre-existing check at sys_mqueue.c:577 has the identical shape and
is race-reachable as demonstrated by this PoC.