Line-accurate confirmation (no runtime demo; the containment demo on
an INVARIANTS kernel would merely show the designed KKASSERT panic,
while the finding is about PRODUCTION builds where KKASSERT is a
no-op):
sys/_malloc.h:58  #define KMALLOC_CHECK_DOUBLE_FREE  (on by default)
sys/kern/kern_kmalloc.c:968  KKASSERT(slab->fobjs[i] == NULL)  <-- only guard
sys/kern/kern_kmalloc.c:969  slab->fobjs[i] = obj;             <-- unconditional
KKASSERT compiles to ((void)0) without INVARIANTS (sys/sys/systm.h),
so in production: common double free (slot empty) is fully SILENT
(same pointer enters the free ring twice -> two kmalloc_obj callers
get the same object); occupied-slot case kprintf's (:964) then still
overwrites (drops a live free-object pointer). Amplifier for caller
bugs only; no in-tree trigger found.