DF-3426 — mode `unreg 8` (guest #2, 2026-10-14 02:05 UTC) — decisive lines.
(The guest-side run_unreg.log was lost with the post-panic reset; the full
output was captured live by the runner and is reproduced verbatim here.)

  # netstat -m BEFORE:
  7/146632 mbufs in use (current/max):
  256/33296 mbuf clusters in use (current/max)
  0/8260 mbuf jumbo clusters in use (current/max)
  	263 mbufs and mbuf clusters allocated to data
  515 Kbytes allocated to network (0% of mb_map in use)

  REGIF tap0: memsize=343019520 offset=0 tx_rings=1 tx_slots=1024
  txring0: num_slots=1024 cur=0 avail=1023 reserved=0 buf_size=2048 buf_ofs=7372800
  [unreg-lap1] cur=8 avail(before sync)=1023 -> NIOCTXSYNC
  [unreg-lap1] after: avail=1015 reserved=0
  closing fd -> generic_netmap_register(0) m_freem()s every tx_pool entry
  trigger rc=0

  # netstat -m AFTER (guest alive, no panic):
  7/146632 mbufs in use (current/max):
  248/33552 mbuf clusters in use (current/max)
  0/8260 mbuf jumbo clusters in use (current/max)
  	255 mbufs and mbuf clusters allocated to data
  499 Kbytes allocated to network (0% of mb_map in use)

  # console (serial):
  RIG: txsync enter: cur=8 hwcur=0 ntc=0 hwavail=1023 resv=0

=> 8 packets dispatched (slots 0..7, each freed synchronously by
   tapifstart()->ifsq_purge() inside ifq_dispatch()), then close(2) ->
   generic_netmap_register(0) m_freem()s every pool entry
   (netmap_generic.c:275-280) -> the 8 dispatched slots are freed a
   SECOND time.  "mbuf clusters in use" drops 256 -> 248 = exactly -8:
   8 decrements with no matching allocations = 8 double frees,
   deterministically, on a live guest.