FIX-RUN (patched kernel #1 Thu Oct 8 12:55:40 UTC 2026, fix.diff applied to
/usr/src, nativekernel + installkernel):

Command (host):
    $ cd dfbsd-qemu && timeout 60 ./vm.sh run_root \
        'echo FIX-RUN-START; kldload /tmp/df5603/df5603.ko; echo "kldload rc=$?"; kldunload df5603; echo done'
    ssh-exit=0 ; vm.sh status => up

Output:
    FIX-RUN-START
    kldload rc=0
    done

dmesg / serial console:
    DF-5603: calling mmc_switch(timeout=0) as mmc.c does for a card with EXT_CSD[248]=0 ...
    DF-5603: mmc_switch returned 4 WITHOUT panicking (KASSERT not compiled in or fix applied)
    DF-5603: calling mmc_switch_status(timeout=0) (second KASSERT site) ...
    DF-5603: mmc_switch_status returned 4 WITHOUT panicking

(4 = MMC_ERR_FAILED, returned because the harness's fake bridge dispatch
resolves to kobj_error_method() == ENXIO; the point is: no panic, both
KASSERT sites neutralized, guest survives module load AND unload.)

Result: baseline panic GONE with fix.diff applied; behavior under the
card-derived timeout==0 becomes a clamped 500 ms poll budget that fails
cleanly through the normal error path.