DF-4116 run log — audit guest, 2026-09-18 (UTC), vm.sh sessions
==================================================================

Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
     (stock kernel; sys/config/X86_64_GENERIC:56 options INVARIANTS)

----------------------------------------------------------------------
RUN 1 (minimal trigger, stock kernel; sound.ko NOT loaded at boot):
  $ kldload sound && echo LOADED && kldunload sound && echo UNLOADED-CLEAN
  ssh session KILLED mid-command (vm.sh timeout) -> guest down in ddb.
  serial console (panic.txt):
    panic: sbuf_delete called with uninitialized or corrupt sbuf
    cpuid = 4
    _assert_sbuf_integrity() at _assert_sbuf_integrity+0x42
    _assert_sbuf_integrity() at _assert_sbuf_integrity+0x42
    sbuf_delete() at sbuf_delete+0x1b
    sndstat_sysuninit() at sndstat_sysuninit+0x8c 0xffffffff8261d46c
    linker_file_unload() at linker_file_unload+0x3aa
    sys_kldunload() at sys_kldunload+0x81
    Debugger("panic")  -> db>
  vm.sh status => down

----------------------------------------------------------------------
RUN 2 (A/B control on one fresh boot, stock kernel):
  A) kldload sound; head -c 32 /dev/sndstat >/dev/null (open+read+close);
     kldunload sound
       LOADED / OPENED-READ-CLOSED / UNLOADED-CLEAN rc=0     <- NO panic
      (model: sndstat_open sbuf_new'd the sbuf and sndstat_close's
       SNDSTAT_FLUSH deleted it and set buflen = -1)
  B) kldload sound; kldunload sound   (no /dev/sndstat open)
       ssh session KILLED mid-command; vm.sh status => down
       serial console (panic.2.txt): identical trace to RUN 1.
  A and B on the SAME boot isolate the single state variable
  (sndstat_buflen) as the deciding factor.

----------------------------------------------------------------------
FIX VALIDATION (vm.sh reset with-src; /usr/src/sys/dev/sound/pcm/sndstat.c
patched with fix.diff; module rebuilt in /usr/src/sys/dev/sound/sound,
make -Werror clean, sound.ko md5 9422fb6783b984413d3a47ef55d4fbc7):

  C) exact RUN-1 trigger against patched module:
     kldload /usr/src/sys/dev/sound/sound/sound.ko && kldunload sound
       LOADED-PATCHED / UNLOADED-CLEAN rc=0                   <- panic GONE
     plus 3 consecutive load/unload cycles: "cycle 1/2/3 clean"

  D) busy-protection regression check (patched module):
     kldload patched; (sleep 12 < /dev/sndstat &); kldunload sound
       -> kldunload: can't unload file: Device busy   rc=1     <- intact
     after holder exits: kldunload sound -> rc=0              <- clean

Baseline vs patched summary:
  | test                                   | stock sound.ko | patched |
  |----------------------------------------|----------------|---------|
  | load+unload, no /dev/sndstat open      | PANIC (3 runs) | CLEAN   |
  | load+open+close+unload                 | CLEAN          | CLEAN   |
  | unload while /dev/sndstat held open    | EBUSY (design) | EBUSY   |
  | 3x load/unload cycles                  | n/a (panics)   | 3/3 OK  |

Prior independent observations of this same panic (root-cause
unresolved until now): DF-4026 panic.sndstat-unload.txt (2026-09-17,
kldunload snd_hda; kldunload sound), DF-4115 pack §5 (kldunload
snd_hda cascade), emu10kx session.