=== DF-4623 baseline run (stock X86_64_GENERIC kernel, INVARIANTS on) ===
# Phase A: safe mode (fire=0) — real engine sanity + projection
[df4623] loaded (fire=0)
[df4623] private vq 'df4623-probe' allocated: nentries=64 free=64 head=0 (dev=vtblk0 index 63 never registered with host)
[df4623] enqueue A: head=0 free=61 queued=1
[df4623] legit completion: dequeue -> cookie 0xaaaa0001 (want 0xaaaa0001) free=64 head=0 used_cons=1
[df4623] PROJECTION of duplicate used id=0 (production kernel):
[df4623]   free_chain: vq_free_cnt += 0 (ndescs of stale head)
[df4623]   dxp->ndescs underflows to 65533 after 2 NEXT hops (VQASSERT(==0) at :796 is a NO-OP without INVARIANTS)
[df4623]   then desc[2].next = vq_desc_head_idx(0) -> CYCLE, head=0 while chain is idle
[df4623]   next virtqueue_enqueue() walks head=0 .. and terminates at desc[2].next == 0 (the cycle) => head NEVER advances
[df4623]   => every new request is handed desc 0..2 again, vq_descx[0].cookie overwritten while previous request is IN FLIGHT (completion mis-attribution)
[df4623]   with F_NEXT forged on desc[2], a vq_ring_free_chain(0) walks >256/64 entries without terminating => permanent kernel spin with the driver serializer held (hard hang)
[df4623] SAFE MODE done

# Phase B: fire mode (hw.df4623.fire=1) — forged DUPLICATE used-ring id
[df4623] loaded (fire=1)
[df4623] private vq 'df4623-probe' allocated: nentries=64 free=64 head=0 (dev=vtblk0 index 63 never registered with host)
[df4623] enqueue A: head=0 free=61 queued=1
[df4623] legit completion: dequeue -> cookie 0xaaaa0001 (want 0xaaaa0001) free=64 head=0 used_cons=1
[df4623] FIRE: forging DUPLICATE used id=0 and calling the real virtqueue_dequeue()...
panic: vq_ring_free_chain: df4623-probe - failed to free entire desc chain
cpuid = 1
Trace beginning at frame 0xfffff80117a9f728
vq_ring_free_chain() at vq_ring_free_chain+0xed 0xffffffff80a744cd
virtqueue_dequeue() at virtqueue_dequeue+0x53 0xffffffff80a75273
df4623EventHandler() at df4623EventHandler+0x2a9 0xffffffff826002a9
module_register_init() at module_register_init+0x49 0xffffffff806232e9
linker_load_file.part.3() at linker_load_file.part.3+0x1b9 0xffffffff80624619
Debugger("panic")

# ssh session died (guest wedged in ddb); full serial capture in panic.txt