DF-3170 run log (assembled from live session capture, 2026-09-07 UTC)

[1] guest: fresh boot after `vm.sh reset with-src`
    DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
    root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
    hw.ncpu: 6, vfs.usermount: 0

[2] root setup:
    $ mkdir -p /mnt/mfs && chmod 1777 /mnt/mfs && (mount_mfs -s 32768 swap /mnt/mfs &)
    $ mount | grep mfs
    /dev/mfs899 on /mnt/mfs (mfs, asynchronous, local)
    $ ps axl | grep mfsidl
        0    899      1  31 205   0  23140    936 mfsidl   S5s    ??    0:00.03 mou
    $ ls -l /dev/mfs899
    crw------- 1 root wheel 255, 0xffff00ff Sep  7 15:51 /dev/mfs899

[3] unprivileged stress (user maxx, 6 writers, 6 vCPUs):
    $ for i in 1 2 3 4 5 6; do (/tmp/mfsrace /mnt/mfs 2 > /tmp/mfsrace.$i.log &) ; done
    pid 922 hammering 2 files in /mnt/mfs
    pid 924 hammering 2 files in /mnt/mfs
    pid 926 hammering 2 files in /mnt/mfs
    pid 928 hammering 2 files in /mnt/mfs
    pid 930 hammering 2 files in /mnt/mfs
    (per-writer iteration counters went to /tmp/mfsrace.*.log in-guest;
     guest later reset for the next test — counters lost, elapsed ~3 min
     of continuous O_SYNC pwrite/pread traffic before the panic)

[4] RESULT after ~3 minutes — serial console (vm.sh log):
    panic: Bad link elm 0xfffff8004f593d48 prev->next != elm
    cpuid = 5
    Trace beginning at frame 0xfffff80117f12668
    mfs_start() at mfs_start+0x499 0xffffffff80913849
    mfs_start() at mfs_start+0x499 0xffffffff80913849
    vfs_start() at vfs_start+0x3b 0xffffffff8070d55b
    sys_mount() at sys_mount+0x52f 0xffffffff80700ccf
    syscall2() at syscall2+0x11e 0xffffffff80bd6a0e
    Debugger("panic")
    CPU5 stopping CPUs: 0x0000001f
    ssh dead -> vm.sh status: down

VERDICT: reproduced — unprivileged concurrent file I/O on a mounted MFS
corrupts the mfs bio queue TAILQ across CPUs; INVARIANTS kernel panics in
the consumer (mfs_start). See panic.txt / VERDICT.md.