FIX VALIDATION — all three fixes in one kernel (nfs_serv.c patched in guest /usr/src)
build: cd /usr/src && make -j4 nativekernel KERNCONF=X86_64_GENERIC   (full /root/build.log, 5831535 bytes, ends ">>> Kernel build for X86_64_GENERIC completed ... BUILD_RC=0"; excerpt in build.log)
install: make installkernel KERNCONF=X86_64_GENERIC (INSTALL_RC=0)
patched kernel: DragonFly dfbsd 6.5-DEVELOPMENT #1: Fri Sep  4 21:02:10 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
baseline kernel: #0: Thu Jul 2 06:02:54 UTC 2026 (all three bugs reproduced on it)

=== DF-2995 (leak) — baseline: +599 mbufs / 300 req (linear, permanent) ===
fixed kernel, gatherdelay_v3=5000:
  300 malformed WRITEs  -> 7 -> 307 mbufs
  600 more (900 total)  -> 307 (FLAT)
  900 more (1500 total) -> 307 ... then 607 (bounded step — reply-cache retention,
                            flat across batches, does not scale with request count)
  => per-request leak ELIMINATED (bounded retention only; buggy kernel grew
     +2/request without bound).

=== DF-2993 (READDIR count=0) — baseline: no reply, thread spin, host starvation ===
fixed kernel:
  readdir(count=8192) -> reply OK                      (normal path intact)
  readdir(count=0)    -> reply nfs-status!=0 (NFSERR_TOOSMALL, immediate)
  post-trigger NULL   -> 0.0001s                       (guest fully responsive)

=== DF-2994 (public fh LOOKUP) — baseline: instant panic ===
fixed kernel:
  lookup0(pub,'/')    -> reply                         (normal reply, NO panic)
  post-lookup NULL    -> 0.0002s                       (guest fully responsive)

All three previously-observed bad behaviors GONE on the patched kernel.