DF-3118 runs on the guest (full story in VERDICT.md)

RUN 1 (organic, ioctl spam only): 12 unpriv burners, 22 min, ~65k ops/s each
  (~780k/s aggregate), 914,588,507 sequence numbers allocated.
  seqshift probe: done=914583800 next=914588507 gap=4707
  => the single master flusher thread consumed 914.58M of 914.59M:
     the ring distance never grows; the 2^31 lap is NOT reachable this way.
  (see wedge_boot.log for the captured dmesg lines)

INJECTED-STATE RUN (mechanism proof): seqshift.ko (root, setup) set
  next = done + 2^31 - 200000  => next negative while done positive.
  Group created at the wrapped frontier -> hammer_flusher_flush() at
  hammer_flusher.c:338-357 mis-sequences the group (difference wraps,
  KKASSERT passes, flg set NULL), group becomes permanently pending,
  hammer_flusher_haswork() true forever -> master runs a synchronous
  finalize (disk flush) per dummy sequence -> self-sustaining I/O storm.
  OBSERVED: guest wedged within ~120 s, ssh banner timeout (25 s and 30 s
  retries ~5 min apart), serial console silent, QEMU still running; only a
  hard reset recovers. No panic text (KKASSERT passes due to the wrap).

RUN 3 (organic, spam + dirty-data load): 12 burners + grouper + 4 writers
  (11.3 GB dirtied in 7 min on the 40G FS):
  t+2min: done=31411132  gap=8949
  t+7min: done=179837951 gap=5541
  2 s after killing the burners: done=197357564 next=197357566 gap=2
  => even under heavy I/O load the master drains the backlog instantly;
     organic reachability of the 2^31 lap is refuted on this (fast-disk)
     configuration.