DF-3380 — FIXED-KERNEL validation run (kernel #1, Fri Sep 11 21:24:50 UTC 2026, INVARIANTS,
built in-guest from /usr/src with fix.diff applied: make nativekernel KERNCONF=X86_64_GENERIC)

$ cc -o /root/trigger_df3380 /root/trigger_df3380.c
$ kldload pf && ifconfig pfsync0 create 2>/dev/null
$ /root/trigger_df3380 lo0
[*] issuing SIOCSETPFSYNC(syncdev=lo0) on pfsync0 ...
[+] SIOCSETPFSYNC ok: pfsync_bulkfail callout armed, panic expected in ~5s on INVARIANTS kernels
[+] SIOCGETPFSYNC: syncdev=lo0 maxupd=128
Fri Sep 11 21:34:14 UTC 2026
SURVIVED_CALLOUT                                    <-- 12s window, no panic
Fri Sep 11 21:34:26 UTC 2026
ifconfig: SIOCIFDESTROY: Invalid argument           <-- destroy refused (ifp busy w/ membership); not fix-related
$ dmesg | tail -2
swap low/high-water marks set to 41940/62910
pfsync0 demoted group carp to 1pfsync0 demoted group pfsync to 1
                                                    <-- PROOF pfsync_bulkfail actually EXECUTED
                                                    <-- (demotion side-effect ran to completion
                                                    <--  under the acquired pf_token), no assert
SSH_RC=0, guest up throughout.

Baseline vs patched:
  stock  #0: same trigger -> panic at if_pfsync.c:1621, guest dead in DDB (run.baseline.log)
  patched #1: same trigger -> callout fires and completes, guest up (this log)
fix_status: fixed