DF-3385 baseline run record (stock X86_64_GENERIC #0)
=====================================================

    # kldload pf.ko
    # ./hfsc_initvf_null

Deterministic PoC stdout up to the trigger (the panic kills the ssh
session at the ping; the same output is visible in full on the patched
kernel -- run.fixed.log):

    altq ticket=1
    hfsc discipline added
    root class qid=1 (lssc m2=1Gbps)
    curve-less intermediate class qid=2 (all hfsc_opts zero)
    leaf class qid=3 (lssc m2=10Mbps, default class)
    committed; hfsc attached to vtnet0
    altq enabled on vtnet0

    *** SENDING ONE PACKET -- EXPECT FATAL TRAP 12 (NULL deref) IN init_vf/rtsc_min ***
    [guest panics here -- see panic.txt]

Serial console at that moment (full capture in panic.txt):

    Fatal trap 12: page fault while in kernel mode
    cpuid = 2; lapic id = 2
    fault virtual address   = 0x0
    fault code              = supervisor read data, page not present
    ...
    Stopped at      rtsc_min+0x11:  movq    (%rsi),%r12
    db>

Reproduced twice from clean resets (cpuid=2 and cpuid=0 runs).

Note: an attempt to keep the PoC stdout in a guest-side file
(> /root/run.baseline.log) failed for evidence purposes -- the panic
leaves HAMMER2 with no chance to flush, so the file did not survive the
power cycle.  The serial console (panic.txt) is the durable record.