# DF-3601 controlled reproduction run 2 (2026-09-15 07:29 UTC)
# Guest: DFly 6.5-DEVELOPMENT X86_64_GENERIC + QEMU intel-hda/hda-duplex, snd_hda KLD

$ vm.sh run_root 'sysctl "dev.hdaa.0.config=softpcmvol"'
dev.hdaa.0.config: forcestereo,ivref50,ivref80,ivref100,ivref,vref -> softpcmvol
CONTROL_WRITE_OK                       # tree-neutral hdaa sysctl write: fine

# t=0, session A (killed by outer `timeout 30`):
$ ssh dfbsd 'date; sysctl dev.hdaa.0.reconfig=1; echo RECONFIG_RETURNED_rc=$?; date'
Tue Sep 15 07:29:07 UTC 2026
dev.hdaa.0.reconfig: 0                 # pre-write read-back printed; write syscall NEVER returns
                                       # (no RECONFIG_RETURNED_rc line, no trailing date)

# t+7s, session B (lock-poisoning probe):
$ ssh dfbsd 'timeout 5 sysctl kern.osreldate; ...'
kern.osreldate: 600519
B_SYSCTL_rc=0                          # this CPU not yet poisoned
B_PS_rc=0

# t+~120s:
$ ./vm.sh status
<no output, command itself timed out after 45s>   # new ssh sessions now hang: system-wide wedge

$ vm.sh status => down (ssh dead); qemu pid alive; serial console silent (no panic).
# Same outcome in run 1 (accidental): boot.log.firstwedge, console stops after attach msgs.