# DF-3407 baseline run (stock kernel #0, INVARIANTS)
#
# Invoked:  /root/race_tun 60    (as root, via ssh)
#
# The guest panicked BEFORE the PoC's final printf could flush over ssh,
# so this capture contains no stdout. The decisive runtime evidence is
# the serial-console capture in panic.txt (and the fact that ssh died
# mid-run and `vm.sh status` reported the guest down, sitting in DDB):
#
#   login: panic: if_clone_free_unit: bit is already cleared
#   cpuid = 0
#   Trace beginning at frame 0xfffff8011846b648
#   if_clone_free_unit.isra.1() at if_clone_free_unit.isra.1+0x49
#   if_clone_destroy() at if_clone_destroy+0x7c
#   tunclose() at tunclose+0x2ba
#   dev_dclose() at dev_dclose+0x93
#   devfs_spec_close() at devfs_spec_close+0x284
#   Debugger("panic")
#
# Wall time from race start to panic: ~110s (60s race window + spawn).
# Reproduction rate baseline: 1/1 runs.