# phase 2 (PANICS): sysctl trigger  [2026-09-25, guest pre-reset]
# ssh-side:
$ sysctl kern.df4996=trigger
kern.df4996: 
(ssh session dies -> command timeout rc=124; guest wedged in ddb)
# serial console (dfbsd-qemu/vm.sh log):
DF4996: sysctl trigger 'trigger'
DF4996: zeroed ic=0xfffff8011935e200 (== ral child softc after failed attach: ieee80211_ifattach() never ran)
DF4996: invoking ieee80211_ifdetach(ic) ...

Fatal user address access from kernel mode from sysctl at ffffffff80751ca4

Fatal trap 12: page fault while in kernel mode
cpuid = 3; lapic id = 3
fault virtual address	= 0x0
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff80751ca4
stack pointer	        = 0x10:0xfffff80117df7758
frame pointer	        = 0x10:0xfffff80117df7768
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 2760
current thread          = pri 6 
kernel: type 12 trap, code=0

CPU3 stopping CPUs: 0x00000037
 stopped
Stopped at      ieee80211_ifdetach+0x124:       cmpq    (%rdx),%rbx
db>
# ieee80211_ifdetach symbol base 0xffffffff80751b80 (kernel); +0x124 = 0xffffffff80751ca4
# recovery: dfbsd-qemu/vm.sh reset with-src  (guest left clean)