panic: assertion "*kup < 0" failed in _kfree at /usr/src/sys/kern/kern_slaballoc.c:1477
cpuid = 0
Trace beginning at frame 0xfffff80117e9d658
_kfree() at _kfree+0x47e 0xffffffff806582fe 
_kfree() at _kfree+0x47e 0xffffffff806582fe 
ulpt_close_copy() at ulpt_close_copy+0x3d 0xffffffff8260030d 
hx_close_common.isra.4() at hx_close_common.isra.4+0x50 0xffffffff82600590 
dev_dclose() at dev_dclose+0x54 0xffffffff8062cb74 
devfs_spec_close() at devfs_spec_close+0x284 0xffffffff80921854 
Debugger("panic")

# PROVENANCE (read first):
# This panic is from an EARLY HARNESS VERSION whose ulpt_close copy freed
# the buffer via sc_fifo_open[dir] instead of the closing fifo's own slot
# -- an infidelity vs production (ulpt.c:468 frees the *argument* fifo).
# Under the (correctly firing) race that infidelity double-freed.
# It is kept as evidence that (a) the production-shape race fires within
# seconds under open/close contention, and (b) of the corruption cascade
# class once the sc_fflags gate loses.  It is NOT a claim about production
# ulpt_close behavior.  The recorded runs in run.log use the fixed,
# production-faithful close.  Symbol spelling above as printed by DDB.