DF-5592 decisive run transcript (serial console + dmesg captures; full
console log in panic.txt).  Guest: DragonFly 6.5-DEVELOPMENT
X86_64_GENERIC, stock kernel.

=== mode 3 run first (DF-5593, see that pack) ===
vmstat -m CAM lines before/after:
            CAM_XPT      40   7.71K       0    390M      275   (before)
            CAM_XPT      69   19.2K       0    390M      453   (after)
[PTSIM3] DF-5593: sim->ccb_count=8, ccb_freeq length=8 (each orphaned union ccb ~720 bytes + callout, M_CAMXPT)
[PTSIM3] DF-5593: clean detach (deregister+free): the 8 pooled ccbs are NOT freed by cam_sim_free()
[PTSIM3] DF-5593: detach DONE; 8 ccbs orphaned -- check 'vmstat -m | grep -i xpt' delta

=== mode 1: silent UAF + callback dispatch from freed sim ===
[PTSIM3] mode 1: parked=8 ios=8
[PTSIM3] xpt_done() from kthread done; camisr now BLOCKED on the sim lock we hold
[PTSIM3] bus deregistered (cam_sim refcount back to 1)
cam_devq_release: WARNING active allocations 8 active send 8!
[PTSIM3] cam_sim_free(0xfffff80117738b40) returned; chunk refcount now reads 0 (baseline-unfixed: 0 = already kfree'd while camisr is blocked on our lock; DF-5592-fixed: 1 = cam_simq pin held)
[PTSIM3] sim lock RELEASED -- camisr now runs on the FREED cam_sim chunk
[PTSIM3] after 2s: marker_hit=1 (marker ccb was queued ONLY on the freed sim's doneq)
[PTSIM3] *** UAF CONFIRMED: kernel ran a completion callback out of a cam_sim chunk that cam_sim_free() had already kfree()'d ***

=== mode 4 baseline (pre-fix validation trail) ===
[PTSIM3] mode 4: parked=8 ios=8
[PTSIM3] xpt_done() from kthread done; camisr now BLOCKED on the sim lock we hold
[PTSIM3] bus deregistered (cam_sim refcount back to 1)
[PTSIM3] cam_sim_free(0xfffff801176d5260) returned; chunk refcount now reads 0
[PTSIM3] sim lock RELEASED -- camisr now runs on the FREED cam_sim chunk
[PTSIM3] mode 4: marker_hit=1; freed-chunk refcount slot now reads 0
[PTSIM3] mode 4: completion callback ran; (baseline: on FREED memory)

=== mode 2: crash proof (poisoned freed chunk) ===
[PTSIM3] mode 2: parked=8 ios=8
[PTSIM3] xpt_done() from kthread done; camisr now BLOCKED on the sim lock we hold
[PTSIM3] bus deregistered (cam_sim refcount back to 1)
cam_devq_release: WARNING active allocations 8 active send 8!
[PTSIM3] cam_sim_free(0xfffff801175bd1e0) returned; ...
[PTSIM3] POISON: freed chunk 0xfffff801175bd1e0 sim_doneq head = 0x00dead000 -- unlocking so camisr walks it
[Stopped at      camisr_runqueue+0x53:   movq    0x20(%r15),%rax
db>
(guest down in DDB; full console in panic.txt)