# serial console (dfbsd-qemu/boot.log) after variant C run, unpatched:
panic: Invalid setup reference count

cpuid = 5
Trace beginning at frame 0xfffff801196c45b8
usbd_transfer_unsetup() at usbd_transfer_unsetup+0x16c 0xffffffff80a5466c 
usbd_transfer_unsetup() at usbd_transfer_unsetup+0x16c 0xffffffff80a5466c 
ugen_ioctl() at ugen_ioctl+0x109 0xffffffff80a48779 
usb_ioctl() at usb_ioctl+0xf7 0xffffffff80a41b17 
dev_dioctl() at dev_dioctl+0x65 0xffffffff8062cdb5 
devfs_fo_ioctl() at devfs_fo_ioctl+0x95 0xffffffff80921bb5 
Debugger("panic")

CPU5 stopping CPUs: 0x0000001f
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db> 

# identical signature on the two exploratory hits (cpuid = 2 and cpuid = 1):
panic: Invalid setup reference count
usbd_transfer_unsetup() at usbd_transfer_unsetup+0x16c
usbd_transfer_unsetup() at usbd_transfer_unsetup+0x16c
ugen_ioctl() at ugen_ioctl+0x109
# "Invalid setup reference count" is the USB_ASSERT at
# sys/bus/u4b/usb_transfer.c:1428 -- the SECOND concurrent unsetup of the
# same xfer found info->setup_refcount already 0: the double-unsetup.