FIX-VALIDATION RUN (patched kernel: X86_64_GENERIC #1 Sun Oct 4 08:32:42 UTC 2026,
fix.diff applied to /usr/src/sys/bus/u4b/usb_hid.c, nativekernel + installkernel + reboot)

$ kldload /root/hidrig/hidrig.ko
$ sysctl kern.hidrig_mode=0; sysctl kern.hidrig_fire=1
hidrig: sizeof(struct hid_data)=1088  sizeof(struct hid_item)=100
hidrig: offsetof(hid_data, cur)=24  MAXPUSH=4 MAXID=16 MAXUSAGE=64
hidrig: &cur[k] offset = 24 + k*100; alloc size 1088
hidrig: cur[11]=+1124 cur[21]=+2124 cur[255]=+25524  (object ends at +1088)

$ sysctl kern.hidrig_mode=3; sysctl kern.hidrig_fire=1        # same k=16 trigger as baseline
hidrig: live parser chunk s=0xfffff8011850c680 (size 1088), 9 guards
hidrig: target guard[8]=0xfffff8011850cb00 delta=1152 above s
hidrig: target index k=16: marker 0xc0de0010 at s+1628 = guard[8]+476
hidrig: firing 30-byte descriptor
hidrig: parse done, 1 items returned
hidrig: guard scan done: 0/9 guards corrupted      <-- BASELINE: 1/9 corrupted at +0x1DC
hidrig: mode 3 complete

$ sysctl kern.hidrig_mode=1; sysctl kern.hidrig_fire=1        # far-write attempt (Pop @ 0)
hidrig: mode 1 phase B: allocator churn (free-list stomp)
hidrig: churn alloc 0..224 ok
hidrig: mode 1 complete (no trap in churn)

$ 40 x sysctl kern.hidrig_fire=1 while `find /usr/src -ls` + `find / -name "*.conf" -ls` churn
round 1..40 done
HAMMER_ALL_DONE        <-- BASELINE: Fatal trap 12 in hid_get_item+0x83 at round ~32, guest DOWN

$ vm.sh status -> up; uptime -> 8:38AM up 1 min

================================================================================
SECOND FULL VALIDATION PASS (fresh revert, patched kernel #1 Sun Oct 4 08:46:29,
same fix.diff, nativekernel BUILD_RC=0, installkernel INSTALL_RC=0, reboot clean):

$ for m in 0 3 1; do sysctl kern.hidrig_mode=$m; sysctl kern.hidrig_fire=1; done
hidrig: target guard[8]=0xfffff8011859b980 delta=1152 above s
hidrig: target index k=16: marker 0xc0de0010 at s+1628 = guard[8]+476
hidrig: guard scan done: 0/9 guards corrupted          <-- BASELINE: 1/9 at +0x1DC
(item 2 logmin=0xfeed0001 is now read from IN-BOUNDS cur[0]: the Pop @ 0 was
 rejected by the fix, pushlevel stays 0)
hidrig: mode 1 complete (no trap in churn)

$ 40 x fire=1 with dual find/ churn
HAMMER_ALL_DONE ; uptime: up ; vm.sh status: up

$ kldunload hidrig -> UNLOAD_OK ; dmesg | grep -c "Fatal trap|panic:" -> 0
$ shutdown -r now -> clean reboot, serial log 0x "Fatal trap|panic:|Stopped at"

(The ambiguous 'guest not answering' during the first pass's reset was ssh
timeout on first-boot-after-install database churn -- reproduced as clean here:
unload + monitored reboot are panic-free on the patched kernel.)