== DF-5734 FIX VALIDATION run (patched /usr/src/sys/netbt) ==
guest: DragonFly 6.5-DEVELOPMENT X86_64_GENERIC (fix.diff applied, harness rebuilt verbatim)

=== F1 FIXED RUN ===
$ sysctl hw.hcih_fire_numcompl=1
hw.hcih_fire_numcompl: 0 -> 0
SYSCTL_RC=0            <-- sysctl COMPLETES (baseline: never returned)
ALIVE_AFTER_3S         <-- guest fully responsive (baseline: ssh banner timeout, status down)
console: [harness] pre-fire state: txq PDUs nonempty, head lp_pending=0, head lp_data qlen=1
console: [harness] <- Num_Compl_Pkts (8 bytes): 04 13 05 01 05 00 01 00
console: [harness] injected; ...

=== follow-up arm+fire on same (patched) boot: post-guard state proof ===
$ sysctl hw.hcih_arm_pdu=1; sysctl hw.hcih_fire_numcompl=1
console: [harness] pre-fire state: txq PDUs nonempty, head lp_pending=1, head lp_data qlen=0
         ^^ the FIRST fire's event was processed: hci_acl_complete() returned via the new
            guard (no spin), hci_event_num_compl_pkts() credited num_acl_pkts+=1 and
            hci_acl_start() transmitted the armed fragment (pending 0->1, qlen 1->0).
$ echo RC=0 ; guest alive through 3 more triggers on the same boot (DF-5735/5736 fixed runs)

=== intermediate fix-build artifact (guard-reach proof) ===
fix_guard_panic_serial.txt: the first fix build's guard kprintf used
device_get_nameunit(link->hl_unit->hci_dev); the harness's fake device_t made
that argument evaluation fault IN NETISR CONTEXT:
  [harness] <- Num_Compl_Pkts (8 bytes): 04 13 05 01 05 00 01 00
  [Stopped at      device_get_nameunit:    movq    0x58(%rdi),%rax
  db>
=> the guard code path executes; final guard print is device-independent.