DF-3350 wedge variant (delay=50ms) -- run.2
============================================
command (host): vm.sh run_root 'sysctl net.inet.ip.dummynet.curr_time; nohup /tmp/df3350 50 >/tmp/wedge.log 2>&1 & ...'
result: ssh session produced NO output and hit the 60s tool timeout (RUN_RC=124).

post-trigger observation (host):
  vm.sh status => down                      (ssh unreachable)
  vm.sh pid    => 2420596 (qemu STILL RUNNING)
  vm.sh log    => console idle at "login:"; last kernel lines:
                      ipfw2 initialized, default to deny, logging disabled
                      DUMMYNET initialized (011031)
                  NO panic, NO trap, NO reboot for 40+ seconds after trigger.

interpretation: the kernel is alive but the netisr thread on cpu0
(net.inet.ip.dummynet.cpu=0) is spinning forever inside dummynet()'s
drain loop: ready_event_wfq() reinserts the pipe into wfq_ready_heap
with key == curr_time (t==0 because bandwidth<0), so
    while (h->elements > 0 && DN_KEY_LEQ(h->p[0].key, curr_time))
never terminates (ip_dummynet.c:678). All further packet processing on
that CPU is blocked => permanent, unrecoverable network DoS (no crash
dump, requires hard reset).

Contrast with the delay=0 variant (run.log/panic.txt): same root cause,
NULL-deref panic instead of the spin, because the delay line is empty
when the wfq event fires => TAILQ_LAST() returns NULL at :623.