== DF-3134: setpassive check-then-close races findfd ref-then-use (dn_fd unsynchronized) ==

-- 1) close races in-flight use; fd number RECYCLED by a
      concurrent open (dirfs itself opens constantly)
    consumer used fd=4; setpassive closed it; recycler got fd=4
    [OK] BUG 1a: host recycled the closed fd number to an unrelated open (lowest-free)
    [OK] BUG 1b: consumer's openat(stale fd, 'sentinel') read the DECOY directory's file — WRONG-FILE metadata op
    [OK] BUG 1c: consumer's O_CREAT created a file in the DECOY directory — WRONG-FILE write-side op
    [OK] (the intended directory was NOT touched)

-- 2) close races in-flight use; fd NOT recycled yet
    [OK] BUG 2: openat on the closed fd -> EBADF (use-after-close; in dirfs_alloc_file this also re-enters the DF-0856 node-leak error path)

-- 3) FIXED: dm_token serializes findfd..dropfd against
      setpassive's check+close
    [OK] FIXED: consumer read the CORRECT (mid) sentinel; no wrong-file, no EBADF
    [OK] FIXED: creation landed in the intended directory

== summary: wrong-file=1 ebadf=1 fixed-ok=1 mismatches=0 ==
harness exit code: 2 (2 = BUG CONFIRMED + FIX VALIDATED)