Guest (before the wedge test; guest reset with-src afterwards):
DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
NIC: virtio-net only (no re(4) device) -- driver path hardware-gated;
     protocol replica proves the mechanism on this exact kernel instead.
Guest source /usr/src/sys/dev/netif/re/if_re.c md5 = ea743c5c903e5574c26f0d9cb83f7396 (matches audited tree)
kern_timeout.c callout_stop -> _callout_cancel_or_stop(sync=1) -> ssleep "costp"  (same kernel as DF-3715 proof)

Post-test guest state: stopper thread 1120 D5 wchan=costp permanently wedged;
softclock of the callback CPU stuck inside parked re_tick replica; guest could
NOT be shut down cleanly via ssh (callout starvation) -- force-killed and
reverted to the with-src snapshot. That shutdown failure is itself part of
the impact evidence (system-wide callout starvation from one driver stop).