# run.log — DF-4606 decisive run (run 3, 2026-09-22 ~04:38 UTC)

$ vm.sh run_root 'kldload /tmp/df4606/df4606.ko'
KLDLOAD_RETURNED

$ vm.sh run_root 'dmesg | grep df4606'
df4606: armed; watch for the wedge
df4606: [softclock] callback: framework holds lk, dropping it (== ata-queue.c:557)
df4606: [canceller] acquired lk inside the window (== late ata_interrupt with state_mtx)
df4606: [canceller] calling callout_cancel() (== ata-lowlevel.c:442) ...

$ vm.sh run_root 'sysctl hw.df4606_progress'
hw.df4606_progress: 3                      # 3 == entered re-acquire lockmgr; 4 never reached

$ vm.sh run_root 'ps -axH -o state,wchan,comm | grep df4606c'
B5     costp    df4606c                    # parked in _callout_cancel_or_stop's ssleep("costp")

$ vm.sh run_root 'kldunload df4606'
kldunload: can't unload file: Device busy

$ vm.sh run_root 'sleep 2 && echo SLEEP2_WORKED'      # (run 2)
RUN_RC=124                                            # userspace timer on the wedged callwheel never fires

--- run 2 orderly shutdown of the wedged guest (serial console) ---
Sep 22 04:20:05 dfbsd shutdown: power-down by root:
Shutting down daemon processes:.
Stopping cron.
/etc/rc.shutdown:  timeout expired. Shutdown terminated.: not found
Sep 22 04:21:51 dfbsd init: /bin/sh on /etc/rc.shutdown terminated abnormally, going to single user mode
...
Waiting (max 60 seconds) for system thread bufdaemon to stop...stopped
syncing disks... 0                                      # hangs here forever; vm.sh down force-killed QEMU

--- run 3 orderly shutdown ---
Sep 22 04:41:40 dfbsd shutdown: power-down by root:
Shutting down daemon processes:.
Stopping cron.
...
Sep 22 04:41:45 dfbsd syslogd: exiting on signal 15
(no further progress; vm.sh down: "guest not answering (likely DDB on panic); killing qemu pid ...")

--- run 1 (harness bug, kept for the record) ---
panic: assertion "(count & (LKC_XMASK | LKC_SMASK)) != 0" failed in lockmgr_cancel_beg at /usr/src/sys/kern/kern_lock.c:989
lockmgr_cancel_beg() at lockmgr_cancel_beg+0xb9
_callout_cancel_or_stop() at _callout_cancel_or_stop+0x42d
df4606_canceller() at df4606_canceller+0x69
# proves callout_cancel enters the AUTOLOCK LK_CANCEL_BEG path while the
# callback is INPROG between its internal release and re-acquire.