Line-accurate confirmation of the COW store protocol gap (the race
window itself is two instructions wide under preemption - not
triggerable with any reliability, per the Info/speculative filing):
sys/kern/kern_plimit.c:98-104 readplimits loads p->p_limit under
   spin_lock_shared(&p->p_spin) then increments p_refcnt in a
   separate atomic instruction
sys/kern/kern_plimit.c:193 (plimit_lwp_fork) and :225-226 region
   (plimit_modify) store the new p->p_limit WITHOUT p_spin - the
   spinlock serializes readers against each other, not against the
   writer
Cross-process reader schedcpu (kern_synch.c:308 ->
plimit_testcpulimit -> readplimits) can race a single-threaded
target COW swap: if all other references drained between the load
and the increment, the increment lands on freed memory.
CPU-limit kill-overflow sibling candidate was FALSIFIED live (see
existing pack contents: SIGXCPU + survival correct, unsigned
predicate in shipped disassembly).