Line-accurate confirmation (no live in-tree trigger - TCP's only
so_rcv mutators are append/compress; a forced demo would need a new
protocol module):
sys/kern/uipc_socket.c:1747/:1778 sorecvtcp marks mbufs M_SOLOCKED
   and uiomoves directly out of them with the ssb token released
sys/kern/uipc_sockbuf.c:376 sbcompress is the ONLY checker of
   M_SOLOCKED
sys/kern/uipc_sockbuf.c:473-508 sbdrop, :517-535 sbdroprecord,
   :451-465 sbflush, :548-578 sbunlinkmbuf trim/unlink/free
   M_SOLOCKED mbufs unchecked -> concurrent flush during the
   unlocked uiomove = UAF read of freed mbuf data to userspace.
Defense-in-depth asserts added in fix.diff.