# QEMU-monitor forensics of the wedged guest (stock v1 run)
#
# CPU states (info registers, repeated):
#   spinner vCPU: RIP cycling among
#     m_free+0x1c / m_free+0x3c / m_free+0x5c   (sys/kern mbuf free)
#     m_tag_copy_chain+0x20, m_dup_pkthdr+0x0   (m_dup internals)
#     netgraph.ko+0x22c6                        (ng_send_data)
#     ng_tee.ko+0x2e1                           (ngt_rcvdata)
#     RFL.IF=0 in the siocngetc terminal state (interrupts masked)
#   other vCPUs: cpu_idle+0xda (HLT) / cpu_smp_stopped+0x52
#
# Terminal states across the 4 runs (all unrecoverable):
#   1) siocngetc+0x41, IF=0, ~94% host-core spin; Xcpustop+0x20e frames
#      on other CPUs  -> kernel debugger entry polling a dead console
#   2) all CPUs cpu_idle, network catatonic (ssh/ICMP dead)
#   3) CPU0 memmove+0xb0 + CPU1 acpi_hpet_early_get_timecount+0x38
#      (DELAY), others idle -> cross-CPU deadlock
#
# Stack walk of the wedging thread (monitor 'x' virtual dump of its
# kstack around RSP=0xfffff8008d1f8888; symbolized with the guest's own
# nm output of /boot/kernel/{kernel,netgraph.ko,ng_tee.ko,ng_socket.ko}):
#
#   fffff8008d1f8998:  m_free+0x1ce / m_freem+0x15     per-hop churn
#   fffff8008d1f89c8:  netgraph.ko+0x22f0              ng_send_data
#   fffff8008d1f89e8:  ng_tee.ko+0x405                 ngt_rcvdata
#   fffff8008d1f89f8:  netgraph.ko+0x2277              ng_send_data
#   fffff8008d1f8a38:  ng_socket.ko+0x34f              ngd_send
#   fffff8008d1f8a40:  0xfffff80000706174 = "tap\0"    injection sockaddr
#
# -> the sendto -> ngd_send -> ng_send_data -> ngt_rcvdata ->
#    ng_send_data -> m_dup/m_free v1 tee forwarding chain, live.