panic: assertion "(((intptr_t)chunk ^ (intptr_t)z) & ZoneMask) == 0" failed in chunk_mark_free at /usr/src/sys/kern/kern_slaballoc.c:1675
cpuid = 0
Trace beginning at frame 0xfffff8008974b950
chunk_mark_free() at chunk_mark_free+0x99 0xffffffff80655da9
chunk_mark_free() at chunk_mark_free+0x99 0xffffffff80655da9
slab_cleanup() at slab_cleanup+0xbb 0xffffffff8065662b
slotimer_callback() at slotimer_callback+0x11 0xffffffff80687d81
softclock_handler() at softclock_handler+0x1b8 0xffffffff80688438
Debugger("panic")

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

[context: serial console, first trigger run (PoC v2: DIOCXBEGIN(ALTQ) ->
DIOCADDALTQ(interface-spec, tap0) -> SIOCIFDESTROY(tap0) ->
DIOCADDALTQ(queue-spec)). The freed altq_subq chunk's in-band free-list
link (c_Next, chunk offset 0) was destroyed by PRIQ_LOCK/UNLOCK's
lwkt-serializer atomic RMW; the slab-maintenance timer later walked the
poisoned free list into a bogus chunk and asserted. Kernel: stock INVARIANTS
X86_64_GENERIC #0 + ALTQ-enabled pf.ko (in-kernel priq code unchanged).]

--- separate run: live wedge evidence (serial stayed quiet; via ssh) ---
# ps ax -o pid,stat,wchan,command | grep df3443
  1211 D0     aslize   ./df3443_poc tap0
[D0 = uninterruptible kernel sleep; wchan 'aslize' = blocked path of
 lwkt_serialize_adaptive_enter (kern/lwkt_serialize.c:240+) -- PRIQ_LOCK
 sleeping forever on the serializer embedded in freed/reused memory while
 holding pf_token. Guest subsequently locked up completely (ssh banner
 timeout, vm.sh status -> down). See serial_wedge_run.log.]