DF-3426 decisive run: `./trigger tap0 uaf 512 4096 16384` on the UNFIXED
production module (rig copy, verbatim logic + RIG_TRACE prints), guest #3,
2026-10-14 02:1x UTC.

The trigger's own stdout (lap markers, spray counts) was being piped over
ssh and was lost when the kernel panic killed the connection mid-command
(the runner's ssh timed out; see runner transcript).  The authoritative,
untrimmed record below is the QEMU serial console (dfbsd-qemu/boot.log,
saved verbatim as panic_uaf_run2_serial.txt): it shows the module loading,
the RIG traces of both txsync laps, the ring-exhaustion event arming, the
destructor firing with an mbcluster pointer, the m_free<-m_free<-m_freem<-
udp_input backtrace, and the Fatal trap 12 that ended the guest.

--- serial console (untrimmed, from RIG module load to db> prompt) ---

login: tap0: MAC address: 00:bd:2c:16:00:00
netmap: loaded module
603.147258 generic_find_num_desc [149] called
603.151686 generic_find_num_queues [156] called
603.157305 netmap_get_hw_na [1023] Created generic NA 0xfffff8008dfaf5c0 (prev 0)
603.165326 netmap_get_na [1085] getting 0xfffff8008dfaf5c0:tap0 (0)
603.171860 generic_netmap_register [228] rtnl_lock called
603.177590 generic_netmap_register [240] rtnl_lock called
603.184177 netmap_mmap_single [321] cdev 0xfffff8008da31a00 foff 0 size 343019520 objp 0xfffff80117d5b618 prot 3
603.195890 netmap_dev_pager_ctor [208] handle 0xfffff8008d402cd0 size 343019520 prot 3 foff 0
RIG: txsync enter: cur=512 hwcur=0 ntc=0 hwavail=1023 resv=0
RIG: txsync enter: cur=511 hwcur=512 ntc=0 hwavail=511 resv=0
RIG: txsync ring exhausted: ntc=512 j=511 hwavail=0 -> arming event
RIG: generic_set_tx_event e=1023 mbuf=0xfffff8012d4a0600 (SET_MBUF_DESTRUCTOR + m_freem on pool entry)
RIG: generic_mbuf_destructor CALLED m=0xfffff8008d402cc0 (ABI-incoherent ext_free(ext_arg) entry)
Trace beginning at frame 0xfffff8008d1f8890
m_free() at m_free+0x123 0xffffffff806bddc3 
m_free() at m_free+0x123 0xffffffff806bddc3 
m_freem() at m_freem+0x15 0xffffffff806be265 
udp_input() at udp_input+0x2f8 0xffffffff807ccf18 
transport_processing_oncpu.isra.7() at transport_processing_oncpu.isra.7+0x6b 0xffffffff807aee6b 
ip_input() at ip_input+0x71f 0xffffffff807b10ef 
netmsg_service_loop() at netmsg_service_loop+0xe9 0xffffffff807464a9 


Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address	= 0xffffffff00000076
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff8262818f
stack pointer	        = 0x10:0xfffff8008d1f8870
frame pointer	        = 0x10:0xfffff8008d1f8890
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= Idle
current thread          = pri 12 
kernel: type 12 trap, code=0

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      generic_mbuf_destructor+0x3f:   testb   $0x80,0x75(%rdi)
db>

(First reproduction, run 1, differed only in the garbage rcvif value:
fault virtual address = 0x76 -- see panic_uaf_run1_serial.txt.)