DF-3350 FIX VALIDATION -- patched kernel (fix.diff applied, KERNCONF=X86_64_GENERIC #1)
=======================================================================================
setup identical to baseline (kldload ipfw/dummynet, rules 1 + 100).

=== PANIC VARIANT (delay=0) ===
/tmp/df3350 0
  config pipe 1: Invalid argument        <-- setsockopt rejected by new bandwidth<0 check
  rc=1
=== WEDGE VARIANT (delay=50) ===
/tmp/df3350 50
  config pipe 1: Invalid argument
  rc=1
(no panic, no wedge; kldstat still answers; guest alive)

=== POSITIVE CONTROL (bw=1Mbit/s, same code path otherwise) ===
/tmp/df3350_good 0
  [+] pipe 1 configured: bandwidth=1000000 delay=0(ms)
  [+] queue 100 configured (parent=1, weight=1)
  [*] trigger: 1 UDP packet -> 127.0.0.1:9 via lo0
  [*] packet queued; dummynet tick fires in <=1ms...
  [?] survived 5s (delay=0 variant)
  rc=0
  still alive: 6:18AM up 1 min ... load average 0.08

CONCLUSION: baseline panic/wedge (panic.txt, run.2.log) is GONE with fix.diff;
legitimate pipes are unaffected. fix_status = fixed.