# ===== PATCHED: kernel #1 (Fri Sep 4 12:39:28 UTC 2026) with fix.diff =====
$ sysctl net.inet.accf.unloadable=1
net.inet.accf.unloadable: 0 -> 1
$ kldload accf_http
Id Refs Address                Size Name
 4    1 0xffffffff82600000    1f000 accf_http.ko
$ ./srv2975 19001 &
LISTENING port=19001 filter=httpready
$ kldunload accf_http
kldunload: can't unload file: Device busy        <-- EBUSY: ref held by listener
kldunload_rc=1
$ ./cli 19001
connected, sending 1 byte
byte sent (filter upcall should already have fired)
cli_rc=0                                          <-- NO PANIC
$ uname -a | cut -c1-60; echo GUEST_STILL_UP
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1
GUEST_STILL_UP

# refcount releases when the listener goes away:
$ pkill srv2975
$ kldunload accf_http
UNLOAD_AFTER_RELEASE_OK
$ vmstat -m | grep -i accf
               accf       1      56       0    390M        2      # refs dropped, no leak

# functional regression: full request through the (still-loaded) filter:
$ kldload accf_http; ./srv2975 19002 &; printf "GET / HTTP/1.0\r\n\r\n" | nc 127.0.0.1 19002
# accepted+drained normally, no panic, dmesg clean.