Serial-console capture (vm.sh log), RUN 3, 2026-10-03 ~07:58 UTC.
Guest was the STOCK X86_64_GENERIC kernel (options INVARIANTS), because the
`vm.sh reset with-src` between RUN 2 and RUN 3 had reverted the disk (and with
it the previously installed X86_64_NOINV kernel).  The original serial log was
overwritten by the next qemu boot before being saved to a file; the lines
below are the verbatim capture from that session's `vm.sh log 60` output.

    legacy_crash: msix_alloc rc=0 irq=19
    legacy_crash: msix_alloc rc=0 irq=20
    legacy_crash: msix_alloc rc=0 irq=21
    legacy_crash: msix_alloc rc=0 irq=22
    legacy_crash: msix_alloc rc=0 irq=23
    legacy_crash: msix_alloc rc=0 irq=24
    legacy_crash: calling legacy_intr_config(irq=24, LEVEL, LOW); production kernel should panic in ioapic_gsi_search (im_gsi == -1)
    panic: assertion "irq >= 0 && irq < ioapic_abi_legacy_irq_max" failed in ioapic_abi_legacy_intr_config at /usr/src/sys/platform/pc64/apic/ioapic_abi.c:999
    Debugger("panic")

Note: on the INVARIANTS kernel the KKASSERT at ioapic_abi.c:999 fires first
(the debug assert IS the only range guard).  On the production (no-INVARIANTS)
kernel the same trigger proceeds to ioapic_gsi_pin(-1) ->
panic("ioapic_gsi_search: no I/O APIC") -- see run_prodkernel.log.