# DF-3530 run.log — baseline (stock kernel #0, stock ng_ether.ko)
# Command sequence (root, via vm.sh run_root):
#   cd /root/DF-3530 && ./build.sh            # (see build.log)
#   timeout 160 ./race_poc 4 120              # step 1: natural race
#   kldload -n ng_ether
#   kldload ./df3530_harness.ko               # step 2: node->private := NULL on vtnet0
#   ping -c1 -t2 10.0.2.2
#
# --- step 1 output (ssh) ---
[+] DF-3530 natural race: 4 workers x 120s tap create/flood/destroy
[w0] 5227 cycles, 669056 frames
[w2] 5163 cycles, 660864 frames
[w1] 5051 cycles, 646528 frames
[w3] 4898 cycles, 626944 frames
[+] done - no panic on this run (window is nanoseconds; see harness_mod.c)
RACE_EXIT=0
# 20,339 create/flood/destroy cycles, ~2.6M injected RX frames, no natural hit.

# --- step 2 (ssh; session hangs at harness load because the next RX frame
#     on vtnet0 panics the kernel before ping even runs) ---
 4    1 0xffffffff82600000    13000 ng_ether.ko
DF3530: vtnet0 ng_ether node=0xfffff8011728d4a0 private=0xfffff8008d721a98 -> NULL. Next packet -> ng_ether_output/input priv deref.
<ssh session frozen — kernel panicked>

# --- serial console (vm.sh log; full extract in panic.txt) ---
Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address	= 0x10
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff826001fb
current process		= Idle
kernel: type 12 trap, code=0
Stopped at      ng_ether_input+0xb:     movq    0x10(%rax),%rdi
db>

# Analysis of the panic signature:
#   ng_ether_input+0xb, fault VA 0x10 = offset of `lower` in struct private
#   (ifp@0, upper@8, lower@0x10).  %rax == priv == NULL (node was loaded
#   fine: 0xfffff8011728d4a0).  This is the load of `priv->lower` at
#   ng_ether.c:210 with node->private == NULL — the exact post-detach
#   observable state.  Distinct from DF-2587 (ng_ether_output, VA 0x28 =
#   `private` load with node==NULL).