=== DF-4466 fix validation (kernel+dm_target_crypt.ko rebuilt with fix.diff) ===

kernel: DragonFly 6.5-DEVELOPMENT #1: Sun Sep 20 13:35:38 UTC 2026
        root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
module: /boot/kernel/dm_target_crypt.ko Sep 20 13:42 (contains "dmtcdn" drain ident)

--- exact PoC re-run: variant F0 (panicked 3/3 on baseline) ---
[F] cd0 = crypt -> dl0 (12s delay) -> /dev/vn0
[reader 165.7s] warmup pread n=512
[reader 165.7s] REAL pread dispatched (held ~5s in delay)
[F 13.0s] suspend + reload FAST table (crypt->/dev/vn0 direct) + resume => probe is fast, OLD priv freed NOW
[reader 177.7s] pread returned 512 errno=0 (0x9e111cd8...)
[F 24.1s] resume returned => OLD crypt priv is freed; bio completes at ~+12s into freed memory
EXIT=0
(vm stays up)

Analysis of the timeline: resume ENTERED at t=13.0 and RETURNED at t=24.1 --
the destroy path now drains (tsleep "dmtcdn") until the in-flight read
completed at t=24 (reader pread returned 177.7s = dispatch 165.7s + 12s
delay). The read returned the CORRECT plaintext (0x9e111cd8, errno=0), i.e.
it was decrypted through the still-live config before it was freed.
No panic, guest remained up.

--- variant B (write hammer + 10 suspend/reload/resume cycles) on patched kernel ---
[iter 7] suspend+reload+resume done (writes=28934 errors=0)
[iter 8] suspend+reload+resume done (writes=32527 errors=0)
[iter 9] suspend+reload+resume done (writes=36134 errors=0)
[hammer] stopped. writes=36160 errors=0 (if we got here, no panic this round)
EXIT=0
           dm_crypt      43   5.00M       0    390M      559
(vm stays up, allocations stable)