$ scp -F dfbsd-qemu/config findings/poc/DF-4218/ae_replica.c dfbsd:/tmp/
ae_replica.c                            100% |********************************|  (guest scp ok)

$ vm.sh run_root 'mkdir -p /root/kmod/aesink && ... && cd /root/kmod/aesink && make'
(full untrimmed make output: see build.log — compiles clean under -Werror, links ae_replica.ko)

$ vm.sh run_root 'kldload /root/kmod/aesink/ae_replica.ko && sysctl kern.aereplica.arm=1'
kern.aereplica.arm: 0 -> 0

$ vm.sh run_root 'dmesg | tail -3'
ae_replica: loaded (hz=100)
ae_replica: armed ae_tick replica (non-mp callout, ticks hz/10; real ae_tick is hz)

$ timeout 90 vm.sh run_root '(sysctl kern.aereplica.stop=1 &) ; sleep 8; dmesg | tail -4; ps -ax -o pid,stat,wchan,comm | grep costp; echo STOPPER_CHECK_DONE'
kern.aereplica.stop: 0ae_replica: loaded (hz=100)
ae_replica: armed ae_tick replica (non-mp callout, ticks hz/10; real ae_tick is hz)
ae_replica: tick handler BLOCKED on our serializer (fired=148 ran=147) - entering callout_stop()
ae_replica: IF THIS IS THE LAST ae_replica LINE, AB-BA DEADLOCK PROVEN (DF-3715 family / ae instance)
  1135 D4     costp    sysctl
STOPPER_CHECK_DONE

$ sleep 30 ; timeout 60 vm.sh run_root 'ps -ax -o pid,stat,wchan,comm | grep costp; echo STILL_WEDGED_AFTER_30S; sysctl kern.aereplica.stop 2>&1 | head -1; dmesg | tail -2'
  1135 D4     costp    sysctl
STILL_WEDGED_AFTER_30S
[the subsequent sysctl read in the same command never returned; the ssh
 connection timed out — the parked NON-MP callout callback holds the
 Giant/mplock while sleeping on the serializer, degrading the whole
 system, exactly as in the PROVEN DF-3991 ale run]

$ vm.sh log 10   (serial console, last lines)
login: ae_replica: loaded (hz=100)
ae_replica: armed ae_tick replica (non-mp callout, ticks hz/10; real ae_tick is hz)
ae_replica: tick handler BLOCKED on our serializer (fired=148 ran=147) - entering callout_stop()
ae_replica: IF THIS IS THE LAST ae_replica LINE, AB-BA DEADLOCK PROVEN (DF-3715 family / ae instance)
[no further ae_replica output — callout_stop never returned]

$ vm.sh reset with-src     (guest restored to clean-source snapshot; verified: module gone, fresh uptime)