[ 2026-09-21 03:44 UTC — baseline run, stock /boot/kernel/amdgpu.ko ]
ssh command: kldload amdgpu && kldload /root/df4525/df4525demo.ko
(panic killed the ssh session mid-command; decisive output captured from
 the serial console via `dfbsd-qemu/vm.sh log 60` — identical bytes in panic.txt)

login: <6>[drm] amdgpu kernel modesetting enabled.
Sep 21 03:43:06 dfbsd kernel: [drm] amdgpu kernel modesetting enabled.
KLD df4525demo.ko: depends on amdgpu - not available or version mismatch   <- first attempt (MODULE_DEPEND v1 mismatch; dep removed)
linker_load_file: Unsupported file type
DF-4525: sizeof(struct amdgpu_device)=58656 adev=0xfffff8011c7c4000
DF-4525: allocated vddc_entries=0xfffff8008976ba00 vddci_entries=0xfffff8008976ba80
DF-4525: after 1st free: vddc=0xfffff8008976ba00 vddci=0xfffff8008976ba80
    ^^^ dangling: amdgpu_free_extended_power_table() freed both chunks but
    left the pointers non-NULL (amdgpu_dpm.c:779-791)
panic: memory chunk 0xfffff8008976ba00 is already free!
cpuid = 0
Trace beginning at frame 0xfffff80118005738
chunk_mark_free() at chunk_mark_free+0xae 0xffffffff80655dbe
chunk_mark_free() at chunk_mark_free+0xae 0xffffffff80655dbe
_kfree() at _kfree+0x262 0xffffffff806580e2
amdgpu_free_extended_power_table() at amdgpu_free_extended_power_table+0x24 0xffffffff8264cab4
df4525_event() at df4525_event+0x146 0xffffffff873bc146
module_register_init() at module_register_init+0x49 0xffffffff806232e9
Debugger("panic")
    ^^^ second call = the caller-fini free (ci_dpm.c:5877/6321, si_dpm.c:7729,
    kv_dpm.c:3035). Double free caught by the slab allocator. Guest wedged in
    DDB; `vm.sh status` => down (panic confirmed).