DF-3380 — BASELINE run on stock INVARIANTS kernel #0 (Thu Jul 2 06:02:54 UTC 2026)

$ cc -o /root/trigger_df3380 /root/trigger_df3380.c && echo BUILD_OK   # no warnings
BUILD_OK

$ kldload pf; ifconfig pfsync0 create   # pfsync0 auto-created with pf load
$ /root/trigger_df3380 lo0
[*] issuing SIOCSETPFSYNC(syncdev=lo0) on pfsync0 ...
[+] SIOCSETPFSYNC ok: pfsync_bulkfail callout armed, panic expected in ~5s on INVARIANTS kernels
[+] SIOCGETPFSYNC: syncdev=lo0 maxupd=128
Fri Sep 11 21:14:25 UTC 2026

  ... ssh session dies silently during the following "sleep 10" ...

Serial console (see panic.txt / boot_panic_full.log):

panic: assertion "LWKT_TOKEN_HELD_ANY(&pf_token)" failed in pfsync_bulkfail at /usr/src/sys/net/pf/if_pfsync.c:1621
cpuid = 2
Trace beginning at frame 0xfffff800897559b0
pfsync_bulkfail() at pfsync_bulkfail+0x71 0xffffffff826044e1
pfsync_bulkfail() at pfsync_bulkfail+0x71 0xffffffff826044e1
softclock_handler() at softclock_handler+0x1b8 0xffffffff80688438
Debugger("panic")
CPU2 stopping CPUs: 0x0000003b
db>

Guest dead in DDB; vm.sh status => down. Timing: panic ~5s after the ioctl, exactly the
5*hz sc_bulkfail_tmo armed at if_pfsync.c:1168.

Failed-precondition notes (why lo0): with syncdev=tap0 and syncdev=vtnet0 the ioctl
returned ENOBUFS from pfsync_in_addmulti() (if_pfsync.c:1143-1148) BEFORE arming the
callout, so the panic path was not reached; lo0's multicast join succeeds.