DF-5636/5637/5638 FIXED-KERNEL RUN -- kernel #3 (Oct 9 02:13) with fix.diff applied
to /usr/src/sys/bus/smbus/smbconf.c (quickkernel rebuilt + rebooted).
Same rig, same production modules, same tests.

[df5636] attach done: iicbus=0xfffff8011759a440 cdev=0xfffff8008da31b40 busy=0 (now: kldload iicsmb)
[df5636] sanity iicbus_request_bus error=0
[df5636] SANITY: write_ok=1 read_ok=1 starts=2 stops=2
[df5636] F1.1 request(devA=fakebb0)=0 owner=0xfffff8011759a300
[df5636] T(devB): calling smbus_request_bus(iicbb0, how=0x3) softc=0xfffff8008d560e00
[df5636] F1.2 owner while devB parked=0xfffff8011759a300 (devA=0xfffff8011759a300 devB=0xfffff8011759a3a0)
[df5636] F1.3 release(devA)=0 owner=0
[df5636] F1.3w 000ms after release: owner=0xfffff8011759a3a0 t1.done=1
[df5636] T(devC): calling smbus_request_bus(iicbus0, how=0x3) softc=0xfffff8008d560e00
[df5636] F1.4 after 1s of devC request: owner=0xfffff8011759a3a0 devC.done=0 (1 = granted immediately)
[df5636] F1.5 release(devB)=0
[df5636] F1.5b cleanup release(devC)=0 owner=0
[df5636] F1.6 final owner=0 (clean=NULL) t1.done=1 t2.done=1
[df5636] F2.1 request(devA)=0 owner=0xfffff8011759a300
[df5636] F2.2 request(devB, SMB_DONTWAIT)=35 owner=0xfffff8011759a300 caller=0xfffff8011759a3a0 (EWOULDBLOCK: correctly refused)
[df5636] F2.3 cleanup release(devA)=0 owner=0
[df5636] F3.1 request(devA)=0 owner=0xfffff8011759a300 (iicbus now held via iicsmb)
[df5636] F3.2 NON-owner release(devB)=13 smbus owner still=0xfffff8011759a300
[df5636] F3.3 iicbus probe request(devC, DONTWAIT)=35 (EWOULDBLOCK: bridge exclusion intact)
[df5636] F3.4 cleanup release(devA)=0 owner=0
[df5636] F3B.1 request(devA)=0 owner=0xfffff8011759a300
[df5636] T(devB): calling smbus_request_bus(iicbb0, how=0x3) softc=0xfffff8008d560e00
[df5636] F3B.2 owner while devB parked=0xfffff8011759a300 (devA=0xfffff8011759a300)
[df5636] F3B.3 NON-owner release(devC)=13 owner STILL=0xfffff8011759a300
[df5636] F3B.3w t1 verdict: error=0 owner_seen=0 (devA=0xfffff8011759a300)
[df5636] F3B: devB still parked (no bogus wakeup: GOOD on fixed code)
[df5636] F3B.4 cleanup release(devA)=0 owner=0
[df5636] PARK: holding bus with devA=0xfffff8011759a300, parking caller on request(devB, SMB_WAIT=0x1)
[df5636] PARK: woke: request(devB) returned 0 owner=0xfffff8011759a3a0 caller=0xfffff8011759a3a0

--- PARK killability on the fixed kernel (shell output) ---
$ ./df5636ctl park & P=$!; sleep 2
   PID STAT WCHAN
   828 S2     smbreq        <-- S (killable) now, was D4 on stock
$ kill -9 $P; sleep 2
kill -9 WORKED: parker died (PCATCH fix effective)

--- summary of the fixed-kernel run (all four ioctls) ---
F1  summary=0x0  (woken waiter CLAIMS owner; devC parks; releases clean)
F2  summary=0x0  (DONTWAIT refused with EWOULDBLOCK=35)
F3  summary=0x0  (non-owner release EACCES, iicbus probe refused: exclusion intact)
F3B summary=0x0  (no bogus wakeup; waiter stays parked until the real release)