Patched kernel (fix validation, v3 = if_tun.c serialization + if_clone.c lookup/act TOCTOU fix):
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Sat Sep 12 09:05:29 UTC 2026
    root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
make -j6 nativekernel KERNCONF=X86_64_GENERIC -> KERNEL_RC=0
make installkernel KERNCONF=X86_64_GENERIC -> INSTALL_RC=0

Fix-validation runs on the patched kernel:
  race_tun 120  -> 56521 open/close cycles, exit 0, no panic (run.fix.log)
  race_tun 120  -> 59259 open/close cycles, exit 0, no panic (run.fix.2.log)
  tun_eault_leak 30000 -> mbufs flat 8->7 (DF-3408 run.fix.log)

Intermediate iterations (documented in VERDICT.md):
  v1 (tun serialization only): panic moved to tunopen resurrection window
       (panic.2.txt: sysref_get SRF_PUTAWAY via tuncreate/reference_dev)
  v2 (tun serialization + no-resurrect): panic moved back to
       tunclose -> if_clone_destroy -> if_clone_free_unit (framework TOCTOU
       in sys/net/if_clone.c:110-113 lookup/act gap exposed by tun race)
  v3 (v2 + if_clone_destroy holds ifnet_lock across lookup..teardown): clean.