DF-5009 — baseline run (STOCK X86_64_GENERIC kernel, no fix)

# 1. build
root@dfbsd# cd /root/df5009 && make SYSDIR=/usr/src/sys
cc ... -c fakemic.c
cc -Wl,--build-id=sha1 -nostdlib -Wl,--hash-style=sysv -r -Wl,-d -o fakemic.ko fakemic.o

# 2. load: creates the synthetic dual-PHY MII bus
root@dfbsd# kldload /root/df5009/fakemic.ko
fakemic0: <synthetic dual-PHY MII controller (DF-5009)> on motherboard
miibus0: <MII bus> on fakemic0
rlphy0: <RTL8201L 10/100 media interface> on miibus0        <-- instance 0
rlphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
ukphy0: <Generic IEEE 802.3u media interface> on miibus0     <-- instance 1 (sibling)
ukphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 100baseT4, auto
fakemic: dual-PHY MII bus up; default media inst=0 subtype=0x0

# 3. arm: operator selects the sibling-unique media word, then the
#    1 Hz MII watchdog tick runs (mii_tick dispatches EVERY PHY's
#    service with the shared ifm_cur)
root@dfbsd# sysctl -w kern.fakemic_arm=1
kern.fakemic_arm: 0 -> 1
(no prompt returns -- kernel panics)

Serial console (boot.log):
fakemic: operator selects SIBLING PHY media ("ifconfig fakemic0 media 100baseT4")
fakemic: ifm_cur inst=1; invoking MII watchdog mii_tick()
panic: rlphy_service: can't isolate RealTek PHY
cpuid = 2
Trace beginning at frame 0xfffff801166df6f8
rlphy_service() at rlphy_service+0x29e 0xffffffff8056352e
rlphy_service() at rlphy_service+0x29e 0xffffffff8056352e
mii_tick() at mii_tick+0x3a 0xffffffff8055907a
fakemic_arm_sysctl() at fakemic_arm_sysctl+0xb0 0xffffffff826002a0
sysctl_root.isra.5() at sysctl_root.isra.5+0x166 0xffffffff80683d06
userland_sysctl() at userland_sysctl+0x111 0xffffffff806840a1
Debugger("panic")
CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

=> guest dead in DDB; ssh gone (vm.sh status -> down).