DF-3264 race campaign summary (detector kernel #1; "RACE-HIT" would prove
free-during-send-window):

campaign 1 (stock #0): 6 rounds x 512 synproxy states; states expire at
  +120 s and purge frees them mid-flood (state count 520->1025->1027->1028
  per round in /tmp/race.log) - mechanism exercised, no crash.
campaign 2 (detector #1): 6 rounds + 4 parallel flooders - 0 hits.
campaign 3: 12 continuous flooders -> purge thread token-starved
  (inserts/removals frozen: 12080/11565 unchanged over 10 s window) - the
  exclusive acquisition needs ALL cpus token-free; continuous 12-sender
  load denies that. Reduced to 2 flooders -> churn resumed
  (+1539 inserts/+1541 removals in 300 s) - 0 hits.
campaign 4: SYN|ACK egress moved to virtio NIC (spoofed sources
  10.0.2.201/202) to widen ip_output windows (~20-30 us) - 0 hits.
campaign 5: DIOCKILLSTATES tight-loop ioctl hammer (killloop, 1.5M+
  iterations, lifetime removals ~20.7M): accelerates unlink but the FREE
  stays deferred to the purge thread -> no free-during-window possible
  by this route - 0 hits.

Conclusion: 0 RACE-HITs in ~1 h of steady-state racing (~5-10 frees/s
crossing a continuously-open window population). On this guest the
ip_output token-drop window is 3-30 us against ~300 us send cycles =>
per-free overlap probability ~0.05-1%; the purge thread is additionally
starved exactly when window coverage is high. Mechanism is code-certain
(see VERDICT.md); practical trigger not demonstrated inside budget.