== run 1: baseline kernel #0 (stock INVARIANTS), variant "sig" ==
# sysctl debug.use_weird_array=1 ; sh run.sh   (setup.sh done earlier)
+ sysctl debug.use_weird_array=1
+ mount | grep nfspoc
127.0.0.1:/tmp on /mnt/nfspoc (nfs)
+ ./poc /mnt/nfspoc sig
child 914-r1: entering nfssvc(NFSSVC_MNTD, /mnt/nfspoc)   [pid from transcript]
parent: SIGTERM -> child
<ssh session dies here — guest panics>

--- serial console (dfbsd-qemu/vm.sh log) ---
login: panic: memory chunk 0xfffff8008971f880 is already free!
cpuid = 0
Trace beginning at frame 0xfffff8008974b950
chunk_mark_free() at chunk_mark_free+0xae 0xffffffff80655dbe
chunk_mark_free() at chunk_mark_free+0xae 0xffffffff80655dbe
slab_cleanup() at slab_cleanup+0xbb 0xffffffff8065662b
slotimer_callback() at slotimer_callback+0x11 0xffffffff80687d81
softclock_handler() at softclock_handler+0x1b8 0xffffffff80688438
Debugger("panic")

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

Note: the ssh session that ran this PoC hung and was killed by the harness
timeout — the guest was in DDB. Verbatim console capture also in panic.txt.