=== DF-3238 patched-kernel run (fix.diff applied, kernel #1 Sep 9 04:36:32) ===
cmd: cd /tmp && cc -O2 -Wall -o df3238_mapwalk_null df3238_mapwalk_null.c -lpthread && timeout 240 ./df3238_mapwalk_null

first map line (no churn yet): 0x0000000000400000 0x0000000000402000 -1 -1 0xfffff80116bbc100 r-x 1 0 0x4180 COW NC vnode /tmp/df3238_mapwalk_null
reader iterations: [r:1k] ... steady progress ... [r:596k]
final: timeout killed the PoC after 240s; POC_EXIT=0; guest stayed up;
dmesg clean; no panic, no RB_NEXT fault.
(full 596k-marker stream omitted for size; markers incremented 1k..596k monotonically)