$ kldload drm; kldload /tmp/df4919/df4919.ko
$ sysctl hw.df4919_test=2
hw.df4919_test: 0
(ssh session never returns - the guest panicked in the race)
--- serial console (vm.sh log) ---
[DF4919] loaded: sysctl hw.df4919_test=1|2|3 (needs drm.ko loaded first: kldload drm)
[DF4919] test=2 mode=cancel_work_sync panic_on_hit=1: feeder+2 cancellers (or feeder+flusher) hammering one work; probing the unlocked flag reads at _cancel_work():364 / flush_work():331 against the worker transition (:74->:87) and the queue_work() insert publication (:138->:141)
panic: DF-4919: work executed AFTER cancel_work_sync()/flush_work() returned — process_all_work called func on work the caller was told is dead (linux_workqueue.c:74 vs :364)
cpuid = 1
Trace beginning at frame 0xfffff80118e7fa70
wk_func() at wk_func+0x6e 0xffffffff831dd76e
wk_func() at wk_func+0x6e 0xffffffff831dd76e
wq_worker_thread() at wq_worker_thread+0xb0 0xffffffff82649930
Debugger("panic")
CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>