DF-2941 / run.log
login: sysprobe: === DF-2942 trigger A: activate/termination negative-space ambiguity ===
sysprobe: A: alloc refcnt=-1073741824 magic=0
sysprobe: A: activate refcnt=1
sysprobe: A: get/put refcnt=1
sysprobe: A: final put -> termination-in-progress...
sysprobe: terminate#1 obj=0xfffff800897a5100 entry refcnt=-1073741824
sysprobe: DF-2942: sysref_activate() on TERMINATING obj, before=-1073741824
sysprobe: DF-2942: after activate refcnt=1 (RESURRECTED; kern_sysref.c:280 KASSERT passed, no diagnostic)
sysprobe: terminate#2 obj=0xfffff800897a5100 entry refcnt=-1073741824
sysprobe: terminate#2 exit refcnt=0
sysprobe: terminate#1 exit refcnt=0
sysprobe: A: result term_count=2 refcnt=0
sysprobe: A: CONFIRMED DOUBLE TERMINATION (terminate callback ran twice for one object)
sysprobe: === DF-2941 trigger B: put-side count==0 acceptance ===
sysprobe: terminate#1 obj=0xfffff800897a5100 entry refcnt=-1073741824
sysprobe: terminate#1 exit refcnt=0
sysprobe: B1: normal cycle refcnt=0 flags=0006 term_count=1 (putaway)
sysprobe: B2: injected pre-:348 visibility; issuing double-put
sysprobe: B2: layer ACCEPTED double-release: refcnt=-1 (walked 0 -> -1; `count > -0x40000000` branch, no floor guard)
sysprobe: B2: repaired refcnt=0 flags=0006
sysprobe: triggers A+B complete; now DF-2941 B3: real post-putaway double-put (expect KKASSERT panic at kern_sysref.c:303 on this INVARIANTS kernel)
panic: assertion "(sr->flags & SRF_PUTAWAY) == 0" failed in _sysref_put at /usr/src/sys/kern/kern_sysref.c:303
cpuid = 0
Trace beginning at frame 0xfffff801166df7a8
_sysref_put() at _sysref_put+0x182 0xffffffff80620432
_sysref_put() at _sysref_put+0x182 0xffffffff80620432
sysref_probe_modevent() at sysref_probe_modevent+0x289 0xffffffff82600399
module_register_init() at module_register_init+0x49 0xffffffff806232e9
linker_load_file.part.3() at linker_load_file.part.3+0x1b9 0xffffffff80624619
linker_load_module() at linker_load_module+0x116 0xffffffff80625e16
Debugger("panic")
CPU0 stopping CPUs: 0x0000003e
stopped
Stopped at Debugger+0x7c: movb $0,0xbdaf09(%rip)
db>