DF-4773 race attempt 1 (hammer.sh + kldunload): unload clean, guest survived; hammer exited on oid removal.
DF-4773 race attempt 2 (racehammer.sh, values logged): 212 reads all 173693530 (0x0a5a5a5a) then READ-FAIL —
  no in-flight overlap won in 2 attempts; DFly frees rewrite the chunk first word (mode-1 showed 0x0 then 0xdeadbeef),
  so a mid-flight read after free would have shown 0/non-marker. Window exists by construction (DF-4647 mechanism,
  reproduced by that pack); not re-won here.
Side-discovery (harness): a sysctl HANDLER calling sysctl_remove_oid/sysctl_ctx_free self-deadlocks —
  userland_sysctl holds the per-cpu sysctllock SHARED across handler invocation (kern_sysctl.c:1572-1574) and
  removal needs it EXCLUSIVE. Deterministic wedge, verified twice. The real driver fix runs ctx_free from
  detach context, which holds no sysctl lock.