# BASELINE RUNS (stock sound.ko c4a52a5b...)
# [run1] /tmp/es_batt all (5 procs as maxx, 25s alarm):
#   ~90-120s in: ssh dead, serial frozen, qemu 143% host cpu.
#   monitor 'nmi' -> DDB: "Stopped at chn_trigger+0x26a: cmpq %rbx,%rax"
#   (CPU0 spinning in the CHN_REMOVE predecessor walk, holding chn lock)
# [run2] 6x /tmp/es_batt all: partial wedge; DDB ps shows es_batt pids
#   848,850,851,852,994 sleeping wchan 'pcm0' 0xfffff8008d5a1000 via
#   dsp_open / mixer_ioctl / dsp_ioctl -> lockmgr_exclusive -> tsleep
#   (ddb_ps_stuck_threads.txt, ddb_blocked_stacks.txt); pid 849 runnable
#   (the lock holder, sampled on-CPU in chn_trigger).
# [run3] /tmp/trighammer 60 (focused: 4 threads SETTRIGGER START/0 on one
#   shared fd + frag/speed churn + r/w):
#   PANIC <=60s:
#     Fatal user address access from kernel mode from trighammer at ffffffff82644233
#     Fatal trap 12: page fault while in kernel mode
#     cpuid = 3; lapic id = 3
#     fault virtual address = 0x138
#     instruction pointer = 0x8:0xffffffff82644233
#     current process = 953  (trighammer, unprivileged)
#     kernel: type 12 trap, code=0
#     Stopped at chn_trigger+0x263: movq 0x138(%rdx),%rax   [rdx == NULL]
#   => full text in panic.txt; chn_trigger+0x263 disassembly (guest
#   sound.ko, objdump):
#     d230: mov %rax,%rdx            <- +0x260
#     d233: mov 0x138(%rdx),%rax     <- +0x263  (SLIST_NEXT walk step)
#     d23a: cmp %rbx,%rax            <- +0x26a  (== c ? )
#     d23d: jne d230                 <- loop
#
# PATCHED RUNS (sound.ko 0d076339..., _SAFE list ops):
#   3x /tmp/trighammer 60 + 1x 30 + battery attempts: ZERO "Fatal trap" on
#   serial, guest never hard-wedged (DDB samples idle), vm.sh status up
#   throughout. Residual: PoC process can stay blocked in a dsp ioctl
#   (join hangs) - process-local, see VERDICT.md.