# DF-2872 baseline run (stock kernel #0)
# command: kldload /root/poc/tqto/tqto.ko; sleep 8; dmesg | grep tqto; kldunload tqto
tqto: step0 ctrl running
tqto: step1 q1=0xfffff80117bcd180
tqto: step2 threads 0
tqto: step3 armed 5-tick callout (res 0); freeing q1 WITHOUT cancel_timeout
tqto: step4 q1 FREED while callout armed; reallocating...
tqto: step5 alias loop done i=0 q2=0xfffff80117bcd180
tqto: q2=0xfffff80117bcd180 alias of freed q1: YES
tqto: q2 threads 0; waiting for stray callout...
tqto: TIMEOUT TASK RAN (run 1) on queue 0xfffff80117bcd180 (q1 was 0xfffff80117bcd180, q2 is 0xfffff80117bcd180)  <== REALIASED (FREED) QUEUE: UAF CONFIRMED
tqto: RESULT: armed callout fired AFTER taskqueue_free and executed on the reallocated queue
# module then unloaded cleanly (kldunload tqto)