Serial console, unfixed production code, rig with NON-DRAINING taps
(trigger: 48 taps, promiscuous, full filters; injector flooding
Command_Complete events; production hci_mtap -> sbappendaddr to every
tap with no bound):

race4 (2026-10-11 01:16, 6-cpu guest):
[harness] === fire: 99999 injector rounds (64 events each) from cpu 3 ===
Warning: objcache(mbuf pkthdr) exhausted on cpu0!
<guest wedged hard: no trap, no further console output, ssh dead>

race5 (2026-10-11 01:19, taps still not draining fast enough):
[harness] === fire: 99999 injector rounds (8 events each) from cpu 3 ===
Warning: objcache(mbuf pkthdr) exhausted on cpu0!
Warning: objcache(mbuf pkthdr) exhausted on cpu3!
Warning: objcache(mbuf pkthdr) exhausted on cpu2!
Warning: objcache(mbuf pkthr) exhausted on cpu1!
<guest wedged hard; trigger showed accumulating send failures before>

Every allocation in the kernel that needs an mbuf pkthdr fails from
that point on (network stack, swap I/O paths, ...); the guests never
recovered (hard hang, watchdog-level).  This is production code: the
only rig role was generating controller traffic; the UNBOUNDED
accumulation is hci_socket.c's hci_mtap appending to so_rcv with no
ssb_space/hiwat check whatsoever (sbappendaddr increments ssb_cc
forever; nothing drops).