DF-3350 panic variant (delay=0) -- decisive run
================================================
setup (guest, root):
  kldload ipfw
  ipfw add 1 allow ip from any to any via vtnet0     # keep ssh alive
  ipfw add 100 queue 100 ip from any to any via lo0  # O_QUEUE => WF2Q path
  kldload dummynet                                   # audit-target module
  /tmp/df3350 0   # pipe 1 bw=-1 delay=0 ; queue 100 parent=1 weight=1 ; 1 UDP pkt -> 127.0.0.1:9

trigger output: "[+] pipe 1 configured: bandwidth=-1 delay=0(ms)"
                "[+] queue 100 configured (parent=1, weight=1)"
                "[*] trigger: 1 UDP packet -> 127.0.0.1:9 via lo0"
                (ssh died here; rest of the evidence is the serial console)

result: kernel panic < 1 second after the trigger packet; guest dropped to
ddb (db> prompt). Full trap + backtrace in panic.txt. Decisive frame:

  Fatal trap 12: page fault while in kernel mode
  fault virtual address = 0x30
  fault code = supervisor write data, page not present
  current process = Idle            <-- netisr drain thread, cpu0
  Stopped at ready_event_wfq+0x274: addq %rdx,0x30(%rax)

0x30 == offsetof(struct dn_pkt, output_time); %rax == NULL (TAILQ_LAST of the
empty delay line); %rdx == t == 0. This is exactly
  TAILQ_LAST(&p->p_queue, dn_pkt_queue)->output_time += t;   (ip_dummynet.c:623)