RIG BUG #1 (not the finding) — pre-reset serial-console tail, captured live
before vm.sh reset wiped boot.log. The go4268 production race had ALREADY
completed ("dispatch 250: delivered=0 maxplen=0 won=0") when the toggle
thread exited via lwkt_exit() and corrupted the run queue:

    dfwb3: dispatch 250: delivered=0 maxplen=0 won=0
    panic: assertion "(ntd->td_flags & TDF_RUNNING) == 0" failed in lwkt_switch at /usr/src/sys/kern/lwkt_thread.c:815
    cpuid = 0
    lwkt_switch() at lwkt_switch+0x679
    tsleep() at tsleep+0xd22
    rand_thread_loop() at rand_thread_loop+0x1ab
    Debugger("panic")

DFly lwkt_create()d kernel threads are not meant to exit (in-tree users
loop forever). The v2 rig replaced the kernel toggle thread with a
userland toggler writing through the kern.dfwb3.tog sysctl (and, for the
final control attempt, a never-exiting kernel thread that parks in
tsleep() after the race — which triggered the same class of corruption
from a spinning remote kernel thread after ~10 s, see
run.race_ctl_kernel.log; both panics are rig artifacts, ~all race data
was captured before each).