DF-5141 — decisive PoC run, stock kernel (serial console capture, dfbsd-qemu/boot.log)

Guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 (X86_64_GENERIC)
Command (root, over ssh): kldload /tmp/df5141/df5141.ko
Outcome: ssh session never returns (guest drops into ddb); serial console:

login: DF5141: softc=0xfffff8008dd19700 enq2=0xfffff800897a5000 (sz=128) dmat=0xfffff8008bbd64a0
DF5141: mlx_free #1 (mlx.c:453 path) ...
DF5141: mlx_free #1 returned (clean teardown, as designed)
DF5141: v1=0xfffff800897a5000 owns the freed block: YES
DF5141: mlx_free #2 (mlx_pci.c:204, the bug) ...
panic: memory chunk 0xfffff8008bbd64a0 is already free!
cpuid = 0
Trace beginning at frame 0xfffff80118523718
chunk_mark_free() at chunk_mark_free+0xae 0xffffffff80655dbe 
chunk_mark_free() at chunk_mark_free+0xae 0xffffffff80655dbe 
_kfree() at _kfree+0x262 0xffffffff806580e2 
bus_dma_tag_destroy() at bus_dma_tag_destroy+0x4b 0xffffffff80c1ac3b 
mlx_free() at mlx_free+0x11b 0xffffffff8056d30b 
df5141_modevent() at df5141_modevent+0x252 0xffffffff82600252 
Debugger("panic")

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

Notes:
* 0xfffff8008bbd64a0 is the parent DMA tag printed as dmat= before call #1:
  freed by mlx_free #1, freed again by mlx_free #2, caught by the allocator.
* v1 == 0xfffff800897a5000 == the enq2 block: an ordinary kmalloc(128,
  M_DEVBUF) between the two frees took ownership of the mlx_enq2 chunk —
  the second mlx_free's kfree(enq2) is a use-after-free on live-owned
  memory (the tag free panicked first in this run).
* Prior kldload attempts: (1) rejected at link time due to a MODULE_DEPEND
  name mismatch (module removed, rebuilt); (2) transient ssh failure, no
  guest effect; (3) this run — panic.