DF-5011 run.3.log — FIX VALIDATION: dimm.ko + fix.diff, dep-less user pocfix
============================================================================

+ kldload /root/df5011/dimm-fixed.ko
+ kldload /root/df5011/pocfix.ko
+ sysctl hw.dimminfo | head -1
hw.dimminfo.dimm0.node: 0
+ kldunload dimm-fixed
kldunload: can't unload file: Device busy
+ echo 'FIXED(pocfix holds live ref): kldunload dimm-fixed rc=1'
FIXED(pocfix holds live ref): kldunload dimm-fixed rc=1
    ^^ BASELINE WAS rc=0 (drain+free) — PATCHED: veto, object kept alive
+ sysctl hw.dimminfo | head -1
hw.dimminfo.dimm0.node: 0
    ^^ softc still alive (baseline: "unknown oid")
+ dmesg | grep "still referenced" | tail -1
dimm0 is still referenced (ref 1); cannot unload
+ kldunload pocfix
+ echo 'pocfix proper destroy+unload rc=0'
pocfix proper destroy+unload rc=0
    ^^ victim can release its reference properly (dimm.ko still mapped)
+ sysctl hw.dimminfo
sysctl: unknown oid 'hw.dimminfo'
    ^^ object destroyed by its OWNER — correct lifecycle
+ kldunload dimm-fixed
+ echo 'FIXED(list now empty): kldunload dimm-fixed rc=0'
FIXED(list now empty): kldunload dimm-fixed rc=0
+ kldstat | grep dimm
dimm.ko cleanly unloaded at end

(no name-match footgun note: kldunload matches the FILE name; the fixed module
was loaded from /root/df5011/dimm-fixed.ko, hence `kldunload dimm-fixed`.)

RESULT: fix_status=fixed. Baseline defect (silent drain of foreign refs,
kfree of live softc, victim UAF panic) is gone; normal module lifecycle
(load → use → destroy → unload) fully preserved. Post-run serial console
contains zero "Fatal trap" lines.