$ vm.sh reset with-src          # fresh clean-source snapshot boot
guest not answering (likely DDB on panic); killing qemu pid 2258165
down
reverting qcow2 to snapshot: with-src
booting guest headless (daemonized)...
waiting for ssh (dfbsd-maxx)...
up (pid 2277002)

$ vm.sh run_user 'uname -a; ls /usr/src/sys/kern/uipc_msg.c'
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
/usr/src/sys/kern/uipc_msg.c
SRCPRESENT

$ vm.sh run_user 'cc -O2 -pthread -Wall -o /tmp/accept_abort_race /tmp/accept_abort_race.c && nohup /tmp/accept_abort_race 240 &'
BUILD_OK
LAUNCHED
  (run as unprivileged user maxx, uid 1001)

run output (/tmp/df2851_run2.out before panic):
DF-2851 stress: 8 acceptors, 2 killers, 6 connectors, 240 seconds

$ sleep 45; vm.sh status   -> up, process running (pgrep: 828 /tmp/accept_abort_race 240)
$ sleep 90; vm.sh status   -> DOWN  (ssh dies, guest wedged in DDB)

$ vm.sh log  (serial console, decisive lines):
LWKT_RELTOKEN ASSERTION td 0xfffff8008babf000 tok 0xffffffff81218f00 ref 0xfffff8008babf1d8/0xfffff8008babf1d8
REF CONTENT: tok=0xffffffff81269280 count=0000000000000003 owner=0xfffff8008babf000
lwkt_reltoken: release wants pool and got pool
panic: lwkt_reltoken: illegal release
cpuid = 0
Trace beginning at frame 0xfffff8008d1f8a40
lwkt_reltoken() at lwkt_reltoken+0xda 0xffffffff80679efa
lwkt_reltoken() at lwkt_reltoken+0xda 0xffffffff80679efa
netmsg_so_notify_abort() at netmsg_so_notify_abort+0xe9 0xffffffff806c2189
netmsg_service_loop() at netmsg_service_loop+0xe9 0xffffffff807464a9
Debugger("panic")
=> reproduced on run #2 (fresh reset), panic within ~2 minutes of unprivileged stress.
   Run #1 (pre-reset) panicked the same way within 20 seconds.