=== DF-4365 fix-shape validation (fresh guest, backgrounded cross-CPU stop) ===
cmd: kldload; sysctl kern.pcnrepfix_arm=1; sleep 1; (sysctl kern.pcnrepfix_stop=1 &); sleep 6; sysctl kern.pcnrepfix_stat=1
console:
pcnrepfix[stop]: fires=309 ran=1 retries=308 - calling callout_stop
pcnrepfix[stop]: callout_stop RETURNED, pending=0
pcnrepfix[stat]: fires=310 ran=1 retries=309 pending=0
guest healthy after (uptime OK). 308 try-enter retries during the 3s serializer hold,
ZERO parks, ZERO deadlock - vs the baseline protocol's permanent D0/costp + B2/slize wedge.

=== incidental corroboration (kldunload with timer armed -> panic) ===
Earlier run of the replica WITHOUT a callout_stop in MOD_UNLOAD: kldunload while the
tick was armed -> 'Fatal trap 12 ... Stopped at softclock_handler+0xd9' - the armed
callout executed unmapped module text. This is the DF-3669/3681 'execution of unmapped
module text' mode: what happens to pcn_tick if pcn_detach's teardown misses it.