DF-4237 model: sili(4) ccb pool, sc_ncmds=31, devq opening=30, slot 1 reserved, mode=shipped kernel

Scenario C (control): boot-time probe, no in-flight I/O
  free=30 [30 tags cycling, no NULL - probe succeeds on idle port]
  => bug NOT reachable without concurrent I/O (negative control)

Scenario A: XPT_SCSI_IO reprobe (sili_cam.c:944-945), 29 in-flight, device re-reports qdepth=1
  free=1 after 29 in-flight; old ncqdepth=31 so max_tags=30
  PANIC: sili_cam.c:372 xa->tag read through NULL xa after loop held 1 slots (iteration 2/31)
RUN1_EXIT=3

DF-4237 model: sili(4) ccb pool, sc_ncmds=31, devq opening=30, slot 1 reserved, mode=patched (NULL-guarded)

Scenario C (control): boot-time probe, no in-flight I/O
  free=30 [30 tags cycling, no NULL - probe succeeds on idle port]
  => bug NOT reachable without concurrent I/O (negative control)

Scenario A: XPT_SCSI_IO reprobe (sili_cam.c:944-945), 29 in-flight, device re-reports qdepth=1
  free=1 after 29 in-flight; old ncqdepth=31 so max_tags=30
  (patched) loop stopped at iteration 2, pool exhausted (held=1)
  no panic in guarded mode

Scenario B: port-thread / XPT_PATH_INQ(wildcard) probe with saturated queue (30 in-flight)
  free=0 - probe caller holds no devq credit
  (patched) probe deferred, no free ccb
  no panic in guarded mode
RUN2_EXIT=0
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64