### Stock-ioctl spontaneous attempts (modes 1 and 6) — honest negative
run A (mode 1, B-thread cpu5, no external load):
  hw.modeuaf.calls: 20885065267  destroys: 362984059  hits: 0     (~230 s)
run B (mode 1, part of fix-validation baseline cycle):
  hw.modeuaf.calls: 13147963961  destroys: 238221116  hits: 0     (~120 s)
run C (mode 6 = stock ioctl on IRQ cpu0 + host ping flood 100k pkts, 150 s):
  hw.modeuaf.calls: 37828141563  destroys: 833846260  hits: 0
run D (mode 1 on PATCHED drm.ko, regression): calls=1975687446 destroys=60805138 hits=0 (no deadlock)

Total stock compiled-ioctl window entries: ~7.3e10, 0 spontaneous hits on this guest.
The compiled window is ~3 instructions wide (objdump drm.ko: callq drm_mode_object_find;
test rax; mov 0x8(%rax) — drm_mode_obj_set_property_ioctl+0x47..+0x47) — effectively never
preempted in-window under QEMU/KVM. The widened observation of the SAME window
(mode 4 probe: stock find + one added atomic counter store between find-return and the
properties read) hits spontaneously 110-295 times per 30-60 s run.