# DF-4280 baseline (VULNERABLE kernel — captured live on the QEMU guest,
# DragonFly 6.5-DEVELOPMENT #0 Thu Jul  2 06:02:54 UTC 2026, same boot as
# the DF-4279 investigation; ccd.ko loaded, no other ccd users):

## matrix probe A — configure ccd1 (NO I/O), close, separate-fd CCDIOCCLR:
== A: ccd1 SET, NO read, close, separate-fd CLR ==
[+] SET ok size=16352 ileave=32
CCDIOCCLR: Device busy

## matrix probe D — configure ccd2, immediate CCDIOCCLR through the SAME fd
## (fd still open; zero other users):
== D: ccd2 SET(vn2) then IMMEDIATE same-fd CLR, no I/O ==
[+] SET ok size=16352 ileave=32
CCDIOCCLR(samefd): Device busy

## stock tool, unit configured moments earlier by the same session:
ccdconfig -u ccd0
ccdconfig: ioctl (CCDIOCCLR): /dev/ccd0: Device busy

## fstat shows NO process holding any ccd node at that point:
# fstat | grep ccd   ->  (only an unrelated hammer2 pipe line)

## module unload while any unit is (permanently) configured:
kldunload ccd
ccd0: In use, cannot detach
kldunload: 1

# Conclusion: dev_drefs(cs->sc_dev) > 1 is true even with the ioctl's own
# descriptor as the ONLY reference — the permanent make_only_dev reference
# (kern_conf.c:294) makes the guard unsatisfiable.  Every configured unit
# is stuck for the boot: components held exclusively, CCDF_INITED forever,
# module un-loadable.