df4684: === mode 1: wait_empty lockless get_rcu ===
df4684: fence=0xfffff8008f928680 refcount=1 (array ref only M-bM^@M^T the steady state of a completed, unprocessed fence)
df4684: reader :306 rcu_dereference(slot) = 0xfffff8008f928680
df4684: *** fence IRQ fires NOW, preempting the reader ***
df4684: writer :258 dma_fence_signal -> 0
df4684: release(): refcount hit 0 -> call_rcu(&f->rcu=0xfffff8008f928698, free)
drm: expand RCU cpu 4 to 16
df4684: reader :307 dma_fence_get_rcu(0xfffff8008f928680) = 0xfffff8008f928680, refcount resurrected to 3221225472
df4684: reader :313 dma_fence_wait -> 0 (signaled)
df4684: reader :314 dma_fence_put -> SECOND call_rcu enqueued on the same rcu_head
df4684: sleeping 3s while the >=1s delay line (linux_rcu.c rcu_timer) fires BOTH entries...
df4684: [delay-line fired] amdgpu_fence_free equivalent: kmem_cache_free(0xfffff8008f928680)
df4684: post-double-free allocs: a=0xfffff8008f928680 b=0xfffff8008f928900 -> distinct (magazine ordering; the two delay-line frees above are the proof)
df4684: === mode 1 complete ===