TEST-ONLY precondition diff (NOT the finding fix - see fix.diff).

This masks the already-known DF-0139 (SLEEPQ_HASH applies SLEEPQ_HMASK to
only one operand of the XOR, producing a massive out-of-bounds index into
sleepq_chains[] and an immediate wild spin_lock() on the very first call).
Without masking DF-0139 first, sleepq_lock() panics inside spin_lock()
before ever reaching the DF-2915 allocation path, so the end-to-end
trigger for DF-2915/DF-2917 cannot run.  DF-0139 is a separate, known
finding and its authoritative fix belongs to its own report.

Apply inside the guest's /usr/src copy only.  Never apply to the audit
tree.

--- a/sys/kern/subr_sleepqueue.c
+++ b/sys/kern/subr_sleepqueue.c
@@ -80,8 +80,8 @@
 #define SLEEPQ_HSIZE		1024
 #define SLEEPQ_HMASK		(SLEEPQ_HSIZE - 1)
-#define SLEEPQ_HASH(wchan)	((((uintptr_t)(wchan) >> 10) ^ \
-				  ((uintptr_t)(wchan) & SLEEPQ_HMASK)))
+#define SLEEPQ_HASH(wchan)	(((((uintptr_t)(wchan) >> 10) ^ \
+				  (uintptr_t)(wchan)) & SLEEPQ_HMASK))
 
 #define SLEEPQ_LOOKUP(wchan)	&sleepq_chains[SLEEPQ_HASH(wchan)]
 #define SLEEPQ_NRQUEUES		2