pool base            = 0x8004e0000
SRB handed out       = 0x8004e06c0 (pool + 3*SRB_SIZE, interior pointer)
flag combo: CAM_SCATTER_VALID set, virtual SG list (no CAM_SG_LIST_PHYS) -- legal CAM API input

error-path taken: freeing srb=0x8004e06c0 (pool=0x8004e0000 + 1728 bytes)
assertion: z->z_Magic == ZALLOC_SLAB_MAGIC in _slabfree
child wait status: raw=0x100 WIFSIGNALED=0 WIFEXITED=1

[+] DF-3708 CONFIRMED: allocator rejected the interior-pointer free (child exited with status 1).
    The kernel kfree() of a bus_dmamem pool interior pointer trips the same slab checks -> panic on INVARIANTS, silent slab corruption otherwise.
RUN_EXIT=0