=== baseline stock + ROOT hammer, 10 device cycles ===
cycle 0..9 del/add ok
ugen0.2: <QEMU> at usbus0 (disconnected)
uaudio0: at uhub0, port 2, addr 2 (disconnected)
Fatal user address access from kernel mode from hammerc at ffffffff806478a1

=== DF-5253 stock-kernel panic (serial console) ===
Fatal user address access from kernel mode from hammerc at ffffffff806478a1


Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address	= 0x8
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff806478a1
stack pointer	        = 0x10:0xfffff80118bc3708
frame pointer	        = 0x10:0xfffff80118bc3738
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 849
current thread          = pri 10 
kernel: type 12 trap, code=0

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      lockmgr_release+0x11:   movq    0x8(%rdi),%rsi
db> 
=== instrumented-driver traversal proof (earlier run) ===

[instrumented-driver run, earlier boot, verbatim from serial console during
 the same experiment series - 8 cycles with root hammer before the stock run:]
DF5253: RACE HIT: handler reached 2nd lockmgr after teardown (pmc=0xfffff80117b6aa00 chan=1)
DF5253: uninit: freeing mixer lock 0xfffff80119b85800
(20x "DF5253: uninit: freeing mixer lock ..." lines observed across cycles;
 the single RACE HIT above shows a sysctl-write handler traversed past
 uaudio_mixer_uninit_sub()'s sc_mixer_lock = NULL store and reached the
 second lockmgr(sc->sc_mixer_lock, ...) with the field NULL and a stale pmc.)

=== fix.diff kernel + ROOT hammer, 25 device cycles ===
cycle 0..24 del/add ok; guest 'up'; 0 panics; 25x 'pcm0: detached' in dmesg; sysctl val readable after replug