DF-5452 fix_run.log — PATCHED kernel (fix.combined.diff), same PoC:
kldload /root/poc/nxirq/nxirq.ko   ... guest stays up:

nxirq0: <nexus irq cpuid PoC> on motherboard
DF-5452: legacy helper (valid cpuid):   res=0xfffff800895d0868 rid=0
nexus_alloc_resource: invalid cpuid -1 for SYS_RES_IRQ allocation
DF-5452: plain API (cpuid -1 default):  res=0
DF-5452: sizeof(struct rman)=80; nexus indexed irq_rman[-1] == base-80 bytes with the KASSERT compiled out
ALIVE
 6:08PM  up 1 min, 0 users, load averages: 0.07, 0.04, 0.01

Baseline vs patched:
- baseline: panic "nexus invalid cpuid: -1" (INVARIANTS) / unchecked
  irq_rman[-1] OOB (non-INVARIANTS)
- patched: allocation cleanly refused (res=0) with a diagnostic; module
  attaches; guest keeps running; whole normal boot (all devices attaching
  through nexus with valid cpuids) unchanged.