# stock kernel, handshake-orchestrated run (final stock session):
DF2988: scanner parked in callback holding node 0xfffff8011766ed00 (key=311) as its CURRENT element
DF2988: deleter (a DIFFERENT concurrent scanner) RB_REMOVE'd + kfree'd victim 0xfffff8011766ed00 while the other scan holds it as current element - NO fixup occurs (RB_SCAN_INFO tracks only 'node', tree.h:302-306)
DF2988: scanner resumed; re-reading freed node 0xfffff8011766ed00: key=311 (UAF read after concurrent RB_REMOVE+kfree)
# earlier run additionally observed the reclaimer marker through the dangling pointer:
DF2988: UAF READ CONFIRMED via reclaimer marker at node 0xfffff801176b2720
DF2988: UAF CONFIRMED: scan held node 0xfffff801176b2720 as its current element across a concurrent RB_REMOVE+ kfree; post-wake reads observe mutated linkage (l 0->0x5a5a5a5a5a5a5a5a r 0->0x5a5a5a5a5a5a5a5a p 0xfffff801176b2900->0x5a5a5a5a5a5a5a5a) - the header contract 'any item may be deleted during the scan' is NOT honored for another scanner's current element