DF-3376 — reconstructed run log (live polls; in-guest .log files die with
the panicked guests, essential numbers preserved from polling transcripts)

RUN 1 (baseline, full race: 6x churn+walk) ----------------------------
18:21  launched, 6 blasters alive (pids incl. 984)
18:2x  sent=1450 first epoch flip; walk-limited rate ~210 pps/inst
18:26  poll: UP, 6 alive, sent=19050/inst (epoch logs), steady state
       144 prefixes + 72 routers on lists, load normal
~18:28-18:31  GUEST DOWN between polls
       console: panic: rtrequest1_msghandler: rtrequest table req 1,
       failed on cpu1, error 55   [panic.raw.txt]

RUN 2 (baseline, full race, fresh boot) -------------------------------
18:33:40 launched, 6 alive
18:35:25 poll: UP, sent=21800/inst, 130 prefixes live
~18:36-18:37  GUEST DOWN
       console: identical panic signature  [panic2.raw.txt]
       => reproduced 2/2

CONTROL A (churn-only, -W 0, fresh boot) ------------------------------
18:40:05 launched 6x churn-only (no walker storm)
18:41:55 UP, 234000 loops/inst (234k pkts) -- ~117k pps/inst sustained
18:43:52 UP, 450000/inst
18:47:47 UP, 858000/inst
18:50:00 stopped clean after 10 min: >1,015,716 pkts/inst (~6.1M total)
       NO crash  => free-side churn alone is harmless

CONTROL B (walk-only, -C 0, fresh boot) -------------------------------
18:52:07 launched 6x walker-only (no churn => nothing freed)
18:54:02 UP, sent=288168/inst; 145 gif0 NC entries
19:00:13 stopped clean after ~8 min: 1,293,288 pkts/inst (~7.8M total)
       NO crash  => lockless-walk load alone is harmless

=> fatal outcome requires churn (frees under nd6_mtx on netisr0) AND
   walkers (lockless pfxlist_onlink_check on other CPUs) concurrently.

FIX VALIDATION (fix.diff applied, kernel #1 19:14:38) ------------------
19:37:13 launched identical full-race hammer on patched kernel
       (6x churn+walk, same rates; :410 wrapped in nd6_mtx)
~19:40:30 GUEST DOWN (~3.5 min in) — SAME panic signature:
       rtrequest1_msghandler req 1 cpu1 error 55   [fix_panic.txt]
       => fix_status: fix_failed (single-site lockup insufficient;
          remaining lockless RA-tail machinery still races the sweep)