# DF-4473 PoC — concurrent reload TAILQ corruption race

**Build** (guest, after `vm.sh reset with-src` + `kldload dm`):

```sh
cc -o dm_loadrace dm_loadrace.c -lprop -lpthread
```

**Run**:

```sh
./dm_loadrace 6 400 16   # threads, rounds, entries-per-reload
```

**Expected (unpatched)**: kernel panic mid-run —

```
panic: Bad tailq NEXT(0x...->tqh_last) != NULL, last 0x...
dm_table_load_ioctl() at dm_table_load_ioctl+0x6bf
```

(QUEUEDEBUG tailq invariant firing inside the racing TAILQ_INSERT_TAIL;
guest down, reset needed.) If the race only orphans entries in a given run,
the post-run `vmstat -m` "dm" line instead shows residual in-use objects
after remove_all.

**Expected (patched with fix.diff)**: `round 400/400 (ok=2400 err=0)`,
`remove_all: rv=0 (ok)`, no panic, no residual "dm" malloc objects.

Requires root (or operator group).