=== BASELINE RUN: current if_fxp.c callout protocol, replica on guest kernel ===
[guest] kldload /root/fxpkmod/fxp_callout_replica.ko
[guest] sysctl kern.fxr.arm=1; sleep 3
[guest] sysctl kern.fxr.stop_blk=1   (fxp_stop:1577 shape: serializer held, callout_stop)

--- serial console (/dev/console -> boot-fxp-full.log), decisive lines:
fxp_callout_replica: loaded (hz=100)
fxr: armed (fxp_stat_timer shape, hz period)
fxr: handler BLOCKED on our serializer (fired=28 ran=27) - entering callout_stop() [fxp_stop:1577 shape]
fxr: IF THIS IS THE LAST fxr LINE, AB-BA DEADLOCK IS PROVEN (writer stuck D-'costp', softclock B-'slize', MP lock held)

--- ps on the wedged guest (second ssh, /root/ps_wedge3.txt):
    -1 B1     -        softclock 1
    -1 B2     -        softclock 2
    -1 B3     -        softclock 3
    -1 B4     -        softclock 4
    -1 B5     slize    softclock 5
    -1 B0     -        softclock 0
231052 D0     costp    sysctl

--- driver-level attempt context (real fxp0 on QEMU i82557b, hammer cycles):
fxp0: <Intel 82557 Pro/100 Ethernet> port 0xc080-0xc0bf mem 0xfebc0000-0xfebdffff,0xfe008000-0xfe008fff irq 11 at device 4.0 on pci0
login: === fxp race start Thu Sep 17 21:20:42 UTC 2026 ===
=== fxp race2 start Thu Sep 17 21:27:01 UTC 2026 ===
=== fxp race3 start Thu Sep 17 21:30:42 UTC 2026 ===
=== NO WEDGE in 20 cycles ===
=== fxp race4 start Thu Sep 17 21:32:01 UTC 2026 ===
fxp0: device timeout
fxp0: device timeout
fxp0: device timeout
fxp0: device timeout
fxp0: device timeout
fxp0: device timeout