PATCHED-KERNEL RACE RUN (fix validation) ======================================== Kernel: DragonFly 6.5-DEVELOPMENT #1: Fri Oct 2 18:46:22 UTC 2026 (built with fix.diff) Workload: identical to baseline - 6-thread kbdspam (KDSETREPEAT/KDSKBMODE/KDSETLED on /dev/consolectl + /dev/ttyv0), syscons bound to ukbd0 (kbdcontrol -k /dev/kbd2), QEMU monitor device_del/device_add usb-kbd cycling with per-cycle rebind. Batch 1 (race.sh 60 cycles): guest UP throughout, console ioctls kept working, rebind succeeded on manual retry; no panic. Batch 2 (race2.sh ~50 cycles): guest UP, no panic (armed-count logging lost to ssh stdout interleaving; cycle count confirmed via dmesg attach/detach lines). Batch 3 (race2.sh 55 cycles, spammer pid verified before start): guest UP, no panic; run hit host-side 570s timeout mid-batch (exit=124) - guest remained UP and responsive (vm.sh status => up, ssh commands succeed). Cumulative on patched kernel: >150 unplug/replug events under full ioctl spam with syscons bound to the ukbd - ZERO panics (baseline panicked within ~100). Observed post-patch behavior: stale-pointer ioctls return ENODEV instead of dispatching through kbdsw[NULL]->ioctl; syscons rebinds cleanly each cycle.