=== DF-3076 control run (unpatched image, stock kernel) ===
$ sh run76.sh keep ; rm -f /mnt/target.bin as uid 1001
DONE patched=0
MOUNT_OK variant=keep len=keep
RM_RC=0 / ls /mnt -> 0 entries / sync / umount / vnconfig -u
CLEAN_UMOUNT_OK - no panic, guest stays up

=== DF-3076 fix run (fix.diff kernel #1 Sun Sep 6 00:57:37 UTC 2026) ===
$ sh run76.sh A ; rm -f /mnt/target.bin as uid 1001
DONE patched=1 / MOUNT_OK variant=A len=0x80000
RM_RC=0 / 0 entries / CLEAN_UMOUNT_OK

=== serial console (decisive) ===
hammer_blockmap_free: blockmap_free: bad bytes 524288 for a000000022000000
guest: up (no panic)