# DF-2924 — cmd_get_usage_all() walks accounting RB trees without ac_spin

## Code
sys/kern/vfs_quota.c:187 and :202 — RB_FOREACH over ac_uroot/ac_groot
and reads of ac_bytes/ac_limit (:183-184) with NO spinlock, while
concurrent writers mutate the same trees under ac_spin:
* vfs_stdaccount() vfs_quota.c:158-171 (RB_INSERT + chunk updates)
* cmd_set_usage_all() :228-268 (bzero + mass re-insert)

RB_FOREACH/RB_NEXT chase rbe_parent pointers; a concurrent rotation
reverses a parent/child edge, so the successor walk can revisit nodes —
a traversal CYCLE means the reading thread spins forever in kernel mode
(no lock held, never sleeps, unkillable).  Additionally all counter
reads are unsynchronized torn 64-bit reads (accounting garbage).

Trigger (both sides unprivileged when vfs.quota_enabled=1):
writer: "set usage all" with fresh uid sets in a loop (rotations);
reader: "get usage all" in a tight loop.  vqlivelock.c implements this.

## Result on guest
Could not obtain a clean measurement window: the sustained traffic first
exhausts the proplib malloc limit via the sys_vquotactl leak and panics
the kernel ("prop dictionary: malloc limit exceeded" — see DF-2926) in
under 60 s, both at 4096- and 128-entry arrays; a 60 s low-rate run did
not livelock.  The locking defect is directly visible in the source
(walk without lock vs mutation under lock); classification: likely,
not reproduced (masked by DF-2926).

## Fix
Take ac_spin around cmd_get_usage_all's walk (it already only reads;
 contention is bounded), or use a seqlock/version counter for lock-free
 readers.