CORRECTED DETECTOR (shmfork_race2.c): parent attaches at FIXED address 0x50000000;
child counts attach capacity AND probes whether 0x50000000 is mapped.
BURN = (capacity < shmseg) AND (no inherited mapping).

v1 detector was WRONG: it counted capacity < shmseg as slot loss, but the parent's
attacher thread holds one live attachment at fork ~90% of the time, so children
LEGITIMATELY inherit one attached segment (capacity 15 of 16 WITH a mapping at
0x50000000).  The v1 "3622/4000 hit rate" was this normal inheritance, not the race.

v2 results (corrected detector):
  STOCK kernel, 3000 forks:                0 burns
  STOCK kernel + memory pressure, 4000:    0 burns
  PATCHED kernel, 3000 forks:              0 burns
=> race window not observed in 10,000 forks.  The shm_token serialization appears
to keep forks out of sys_shmat's reservation window under tested conditions.
The code gap is real (shmfork bcopy includes reserved=1; sys_shmat requires
reserved==0; nothing clears the child copy) but runtime reachability is NOT
established.  Finding downgraded to not_reproduced.