DF-5061 run.log — decisive runs (assembled from the serial-console captures in
panic.txt / panic.firstboot.txt / fix_run.log; the ssh tee streams for the two
fatal runs were truncated when the panics dropped the connection).

=== boot 1 (baseline build, stage 1: FIXED variant, safe) =================
$ kldload /tmp/df5061/df5061.ko && sysctl hw.df5061_mode=1 && \
  sysctl hw.df5061_fire=1 && kldunload df5061
hw.df5061_mode: 1 -> 1
hw.df5061_fire: 0 -> 1
--- dmesg ---
DF-5061: mock board up: hwqcbs=0xfffff8011870e000 phys=106881000 (VA-phys delta=fffff80011e8d000) regfile=0xfffff800899b0700 R_42XX_REPLY@0xfffff800899b0744=0xffffffff
DF-5061: loaded (mode=1). sysctl hw.df5061.fire=1 to run.
DF-5061 [fixed ] (uint32_t)completed==0xffffffff test:
DF-5061 [fixed ] ida_v4_done_fixed() = 0x0000000000000000 (0 = empty FIFO detected: ida_wait() keeps polling, ida_intr() drain loop exits -- correct, no wild deref)
DF-5061 [fixed ] R_42XX_REPLY untouched: 0xffffffff (no 'confirm read' write on an empty FIFO)
DF-5061: unloaded
--- hardware gate ---
pciconf -l | grep 0e11 -> NO_COMPAQ_PCI (7 PCI devs total, none Compaq)
/boot/kernel/ida.ko -> NO_IDA_KO (driver is compiled into GENERIC:
/usr/src/sys/config/X86_64_GENERIC:132  "device ida  # Compaq Smart RAID")

=== boot 1 (stage 2: VERBATIM variant, fatal) ==============================
$ kldload /tmp/df5061/df5061.ko && sysctl hw.df5061_mode=2 && \
  sysctl hw.df5061_fire=1
hw.df5061_mode: 1 -> 2
[connection dies with the panic — full capture in panic.firstboot.txt]
DF-5061 [buggy ] verbatim ida_pci.c:107 test 'completed == -1' with bus_addr_t=uint64_t and bus_space_read_4=uint32_t:
DF-5061 [buggy ]   0x00000000FFFFFFFF == 0xFFFFFFFFFFFFFFFF ? NO -> sentinel DEAD
DF-5061 [buggy ] ida_v4_done() = 0x00000000ffffffff  (empty FIFO reported as a completion!)
DF-5061 [buggy ] side effect: 'confirm read' write done on EMPTY fifo, R_42XX_REPLY now 0x00000000
panic: assertion "obj != NULL" failed in vm_object_hold_shared at /usr/src/sys/vm/vm_object.c:330
--- trap 000000000000000c, rip = ffffffff826000f6 ---
df5061_fire_sysctl() at df5061_fire_sysctl+0xf6 0xffffffff826000f6

=== boot 2 (fresh vm.sh reset; mode 3 'probe' — proves idahwqcbptov ========
=== cannot even return without the wild deref) =============================
$ kldload ... && sysctl hw.df5061_mode=3 && sysctl hw.df5061_fire=1
[full capture in panic.txt]
Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address  = 0xfffff801625a310c
fault code              = supervisor read data, page not present
instruction pointer     = 0x8:0xffffffff826000b5
...
Stopped at      df5061_fire_sysctl+0xb5:        movq    0x110(%rax,%rdx,1),%r13
[arithmetic: 0xfffff801625a310c == hwqcbs(0xfffff80118498000)
             + (0xFFFFFFFC - hwqcb_busaddr(0xb5ef5000)) + 0x110  -- EXACT]

=== boot 3 (post vm.sh reset with-src; fix validation) =====================
/usr/src/sys/dev/raid/ida/ida_pci.c patched with fix.diff; real ida.ko rebuilt
clean with -Werror (fix_build.log); fixed harness variant re-run:
DF-5061 [fixed ] ida_v4_done_fixed() = 0x0000000000000000 ...
DF-5061 [fixed ] R_42XX_REPLY untouched: 0xffffffff ...
DF-5061: unloaded
(full stream in fix_run.log — no trap, guest alive, module unloaded)