DF-3073 run.log — decisive baseline run (stock kernel #0 Thu Jul 2 06:02:54 UTC 2026)

Session 1 — control: mount works, server-injected device node visible,
clean forced unmount without a holder:

  # mount_nfs -o tcp,port=2049 127.0.0.1:/P /mnt/nfsx && echo MOUNT_OK
  MOUNT_OK
  # ls -l /mnt/nfsx
  total 0
  # ls -l /mnt/nfsx/dev
  crw-rw-rw-  1 root  wheel  255, 0xffff00ff Jan  1  1970 /mnt/nfsx/dev
  # ls -l /mnt/nfsx/slow
  -r--r--r--  1 root  wheel  8192 Jan  1  1970 /mnt/nfsx/slow
  # umount -f /mnt/nfsx; echo UMNTF_RC=$?
  UMNTF_RC=0                              <- no holder: clean

Session 2 — intermediate variant (holder.c, NFS-blocked process) — did NOT
hold: dounmount sets MNTK_UNMOUNTF which makes nfs_sigintr() abort every
in-flight RPC (nfs_socket.c:2059-2066), the blocked process becomes
killable, SIGKILL (retry 7) closes its fds, vflush succeeds:

  # umount /mnt/nfsx
  umount: unmount of /mnt/nfsx failed: Device busy   (clean EBUSY first)
  # ps -o pid,stat,command -ax | grep holder
    957 D4     /tmp/holder /mnt/nfsx        (blocked in withheld READ rpc)
  # umount -f /mnt/nfsx
  UMNTF_RC=0  (2 s; holder was killed, refs dropped, no panic)

Session 3 — DECISIVE (holder2.c, SCM_RIGHTS-parked descriptor):

  # mount_nfs -o tcp,port=2049 127.0.0.1:/P /mnt/nfsx && echo MOUNT_OK
  MOUNT_OK
  # su -m nobody -c '/tmp/holder2 /mnt/nfsx'
  DEV_OPEN_OK
  FD_PARKED
  # ps -o pid,stat,command -ax | grep holder2 | grep -v grep
   1022 S5     /tmp/holder2 /mnt/nfsx       (holds only the socket end)
  # date; umount -f /mnt/nfsx 2>&1; echo UMNTF_RC=$?; date
  Sat Sep  5 23:26:19 UTC 2026
  <ssh session dies here — guest panics ~13 s into the kill-retry loop>

Serial console (full capture in panic.txt):

  unmount(/mnt/nfsx): forced umount of "(null)" - 1 namecache refs, 1 mount refs
  unmount(/mnt/nfsx): (0xfffff8008eddb800): 1 namecache refs, 1 mount refs still present
  unmount(/mnt/nfsx): forcing unmount
  vflush: Warning, cannot destroy busy device vnode
  NFS inodes: slab 0xfffff80118720000 1 objects were still allocated
  malloc_uninit: 576 bytes of 'NFS inodes' still allocated on cpu 6
  panic: unmount: dangling vnode
  cpuid = 2
  Trace beginning at frame 0xfffff801186677b8
  dounmount() at dounmount+0x87c 0xffffffff80701bfc
  sys_unmount() at sys_unmount+0x1f2 0xffffffff80701e02
  syscall2() at syscall2+0x11e 0xffffffff80bd6a0e
  Debugger("panic")
  Stopped at Debugger+0x7c: movb $0,0xbdaf09(%rip)

vm.sh status -> down immediately after.