=== DF-4542 baseline (STOCK kernel, DragonFly 6.5-DEVELOPMENT #0 Jul 2 2026) ===
Round 1 (mode 7: CONS_SET+KD_TEXT1+KDRASTER + writers + VT_ACTIVATE cycler, 60s):
  ssh session died mid-run; vm.sh status => down; serial log (run.panic1_bootlog.txt):
    panic with 1 spinlocks held
    panic: assertion "count & TOK_COUNTMASK" failed in _lwkt_reltokref at lwkt_token.c:458
    cpuid = 2
Round 2 (mode 3: ioctl churn + writers, no VT cycler, 60s):
  ssh session died mid-run; vm.sh status => down (run.panic2_bootlog.txt):
    panic: assertion "count & TOK_COUNTMASK" failed in _lwkt_reltokref  cpuid = 5
Round 3 (mode 1: ioctl churn ONLY, ~2.9M ioctls, 60s): CLEAN, guest alive:
  ttyv1: ioctls=917448 ... ttyv4: ioctls=669324, EXIT=0
Round 4 (mode 2: writers ONLY, ~1.3M writes, 60s): CLEAN, guest alive:
  ttyv1: writes=333156 ... ttyv4: writes=317341, EXIT=0
Round 5 (mode 10: CONS_SET-only + writers - THE MINIMAL PAIR, 60s):
  ssh session died mid-run; vm.sh status => down (run.panic3_bootlog.txt):
    panic: assertion "count & TOK_COUNTMASK" failed in _lwkt_reltokref  cpuid = 5

=== fix v1 (serialize swaps under syscons_mtx only) ===
Patched kernel: panic: BADFREE2 - kfree of unallocated memory
  _kfree() <- sc_vtb_destroy() <- sc_alloc_scr_buffer() <- sc_set_text_mode() <- sc_vid_ioctl()
  (fixv1.BADFREE2_bootlog.txt)  -- proves the raw heap double-free class; v1 insufficient
  because vga_token is dropped at the M_WAITOK sleep, leaving CONS_SET-vs-CONS_SET interleaves.

=== fix v2 (alloc-first M_NOWAIT + commit-under-syscons_mtx + frees outside; kernel #1 10:17:20) ===
Run A (mode 10, 60s): CLEAN  ttyv1: ioctls=116079 writes=249989 | ttyv2: 109344/219716
                          ttyv3: 114570/264506 | ttyv4: 108461/223938   EXIT=0
Run B (mode 7, 60s):   CLEAN  ~143K ioctls, ~727K writes total, VT cycling   EXIT=0
Run C (mode 10, 60s):  CLEAN  ~143K ioctls, ~852K writes total               EXIT=0
Guest alive after all three runs (uptime 4 mins, load 7.79).