DF-4473 baseline (unpatched kernel, dm.ko from clean /usr/src)
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026 (X86_64_GENERIC)

$ kldload dm
$ cd /tmp && cc -o dm_loadrace dm_loadrace.c -lprop -lpthread && ./dm_loadrace 6 400 16
(ssh session died; guest went down -- serial console / boot.log:)

panic: Bad tailq NEXT(0xfffff801173eebf8->tqh_last) != NULL, last 0xfffff80117492080
cpuid = 1
Trace beginning at frame 0xfffff80116a7a638
dm_table_load_ioctl() at dm_table_load_ioctl+0x6bf 0xffffffff8260300f 
dm_table_load_ioctl() at dm_table_load_ioctl+0x6bf 0xffffffff8260300f 
dmioctl() at dmioctl+0x2eb 0xffffffff8260083b 
dev_dioctl() at dev_dioctl+0x65 0xffffffff8062cdb5 
devfs_fo_ioctl() at devfs_fo_ioctl+0x95 0xffffffff80921bb5 
mapped_ioctl() at mapped_ioctl+0x5fa 0xffffffff806a831a 
Debugger("panic")
CPU1 stopping CPUs: 0x0000003d
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

=> Guest down (vm.sh status: down). Full serial excerpt in panic.txt.

The panic message is the QUEUEDEBUG tailq invariant in TAILQ_INSERT_TAIL
(sys/sys/queue.h:629 QMD_TAILQ_CHECK_TAIL) firing inside dm_table_load_ioctl:
two racing reloads both published entries through the same tqh_last and left
the tail pointer referencing a non-tail slot. Without QUEUEDEBUG the same
interleaving silently links through the stale tqh_last (list corruption /
orphaned entries).

--------------------------------------------------------------------------------
DF-4473 fix validation (patched dm.ko built from fix.diff):

$ cd /usr/src/sys/dev/disk/dm && patch -N < /tmp/fix.diff && make && kldload dm_fixed.ko
$ (nohup ./dm_loadrace 6 400 16 > /tmp/race_fixed.log 2>&1 &)
$ sleep 90; tail -5 /tmp/race_fixed.log
    ... round 350/400 (ok=2100 err=0)
    ... round 400/400 (ok=2400 err=0)
[*] remove_all: rv=0 (ok)
[after-race M_DM] (no dm line)
[*] reload stats: ok=2400 err=0; expected entries freed via clear/remove_all; any residual InUse == leaked orphans

=> 400/400 rounds, 2400/2400 reloads OK, NO panic, guest up, and after full
   cleanup the "dm" malloc type has no residual in-use objects (no orphaned
   entries). Unpatched: panic mid-run.

(Note: one earlier patched run wedged in USERSPACE -- an unchecked
pthread_create failure starved the pthread_barrier; the harness now aborts
loudly on create failure. Not a kernel issue: all threads were in umtxsl,
load average 0.00, kernel responsive.)