DF-3171 investigation run log (2026-09-07 UTC) — all three trigger attempts, stock kernels.

ATTEMPT 1 (stock #0, 15:56) — FWRITE open via second devfs:
    root # (mount_mfs -s 32768 swap /mnt/mfs &)      -> /dev/mfs853, server 853
    root # mount -t devfs none /mnt/d2
    root # sh -c "exec 8<>/mnt/d2/mfs853; umount /mnt/d2 || umount -f /mnt/d2"
    RESULT: kernel panic "Bad tailq NEXT(...->tqh_last) != NULL" from
    mfsstrategy (see panic_investigated_misattribution.txt,
    boot_serial.log). ATTRIBUTION RETRACTED: the O_RDWR open fails EBUSY
    (devfs_specopen D_DISK+FWRITE+mounted-RW check, devfs_vnops.c:1006-1020),
    so no fd and no d_close existed; the panic was DF-3170's race fired by
    the concurrently running unprivileged writers (evidence reattributed to
    findings/poc/DF-3170/run.2.log).

ATTEMPT 2 (stock #0, ~17:2x) — read-only open, fd held by short-lived sh:
    root # (mount_mfs -s 8192 swap /mnt/mfs &)       -> /dev/mfs847, server 847
    root # mount -t devfs none /mnt/d2
    root # sh -c "exec 8</mnt/d2/mfs847; echo open-rc=$?"   -> open-rc=0 (RO open works)
    root # umount -f /mnt/d2
    RESULT: server 847 SURVIVED (mfsidl S2s), mount alive, dd I/O fine.
    Why: the sh holding fd 8 exited before the umount; the vnode had no
    open count left for vclean to force-close.

ATTEMPT 3 (stock #0, ~17:2x) — read-only fd held alive across umount -f:
    root # (sh -c "exec 8</mnt/d2/mfs847; sleep 90" &)
    root # umount -f /mnt/d2                          -> umount-rc=0
    RESULT: server 847 SURVIVED (mfsidl S2s), mount /dev/mfs847 still
    listed, mount healthy.
    Why: devfs device opens migrate to the device's PRIMARY vnode
    (devfs_specopen orig_vp handling, devfs_vnops.c:956-1000), so the
    second-devfs vnode carries no open count; its forced reclaim issues no
    VOP_CLOSE, hence no mfsclose.

STOCK NORMAL TEARDOWN CONTROL (works as designed):
    root # umount /mnt/mfs -> rc=0, mount gone, server exited cleanly.

PATCHED-KERNEL GUARD VALIDATION (kernel #1 16:11:15 and #2 16:51:08):
    - holder + umount -f construction: server survives, mount serves I/O;
    - normal lifecycle: mount_mfs -> writes -> umount rc=0 -> mount gone,
      server gone (EMOUNTEXIT), /dev/mfsN removed;
    - no regression under 11+ min multi-mount stress (see DF-3170 pack).

CONCLUSION: hypothesized VRECLAIMED-close trigger NOT reachable via any
constructed path; mfsclose hazard remains code-valid but unmanifested
(requires the in-tree-"XXX NOT SMP SAFE" count_dev miscount or an
equivalent opencount anomaly). Filed Low/speculative; not_reproduced.