DF-5011 panic.txt — guest serial console (dfbsd-qemu boot.log), baseline run
============================================================================
boot: Fri Sep 25 21:59:05 UTC 2026 — DragonFly/x86_64 (dfbsd) (ttyd0)
kernel under test: X86_64_GENERIC #1 without device dimm/ecc/memtemp

login: drainpoc: dimm_create(0,0,0) -> sc=0xfffff800899b0800 ref=1 held by drainpoc
drainpoc: MOD_UNLOAD: dimm_destroy(0xfffff800899b0800) on object freed by dimm_mod_unload's drain (use-after-free / call into unmapped module text)


Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address	= 0xffffffff826004a0
fault code		= supervisor read instruction, page not present
instruction pointer	= 0x8:0xffffffff826004a0
stack pointer	        = 0x10:0xfffff80117ecb8b0
frame pointer	        = 0x10:0xfffff80117ecb8b8
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1538
current thread          = pri 6 
kernel: type 12 trap, code=10

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      -0x7d9ffb60:

Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address	= 0xffffffff826004a0
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff80bc8e40
stack pointer	        = 0x10:0xfffff80117ecb550
frame pointer	        = 0x10:0xfffff80117ecb578
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1538
current thread          = pri 6 (CRIT)
    kernel: type 12 trap, code=0
db> 

NOTE: kldstat immediately before the sequence showed
  4  1 0xffffffff82600000  d000  dimm.ko
so fault VA 0xffffffff826004a0 == dimm.ko text + 0x4a0 — the victim's call
into the freshly-unmapped dimm.ko module text. The module was unloaded by
`kldunload dimm` (rc=0) even though the only dimm_softc reference was held
by the victim module: dimm_mod_unload() drained that foreign reference and
kfree()d the softc before the module text was unmapped.