RIG BUG #2 (not the finding) — fixed-kernel first go4270 run: the rig
dispatched wb_txeof.part.4 unguarded; on the FIXED kernel wb_tx_head is
NULL (nothing armed), and the .part.4 clone's NULL guard lives in the
CALLER (wb_intr checks tx_head != NULL before each call — see its
disassembly), so the dispatch faulted:

    Fatal user address access from kernel mode from sysctl at ffffffff808da51e
    Fatal trap 12: page fault while in kernel mode
    fault virtual address = 0x8
    Stopped at wb_txeof.part.4+0xe: cmpq $0,0x8(%rbx)

ALL fixed-kernel evidence had already printed (LEAK 0, frags disarmed,
TXSTART never issued, tx_head NULL). The rig now guards the dispatch
(mirroring wb_intr); the clean re-run is run.kld_fixed.log (SURVIVED).