login: [l2uh] l2uh_harness loaded: hw.l2uh_setup, hw.l2uh_once, hw.l2uh_race, hw.l2uh_race3, hw.l2uh_state
[l2uh] sizeof(l2cap_channel)=176 offsetof(lc_state)=8 offsetof(lc_link)=0
[l2uh] sizeof(l2cap_req)=64 sizeof(hci_link)=168 offsetof(hl_refcnt)=38 offsetof(hl_txq)=48
[l2uh] hz=100 l2cap_response_timeout=30s hci_acl_expiry=10s ncpu=6
[l2uh] rtx body: l2cap_rtx() -> l2cap_close() runs on the softclock thread; l2cap_detach() runs on the netisr port (close(2)); no lock serializes them
[l2uh] === control: one unraced round ===
[l2uh] armed chan=0xfffff80118429340 state=2 (WAIT_RECV_CONNECT_RSP=2) -- sleeping 3 ticks for the clean rtx fire
[l2uh] after rtx: state=0 (expect CLOSED=0) lc_link=0 (expect NULL) disconnected callbacks=1 (expect +1)
[l2uh] detached. no panic = control OK
[l2uh] rtx kthread pinned to cpu1 (tid 0xfffff800905fc780)
[l2uh] === DF-5749 race3: 2000 simultaneous l2cap_rtx() vs l2cap_detach() rounds ===
panic: zone: freeing free entry
cpuid = 1
Trace beginning at frame 0xfffff801181b9a20
zerror() at zerror+0x28 0xffffffff809c0f18 
zerror() at zerror+0x28 0xffffffff809c0f18 
zfree() at zfree+0x232 0xffffffff809c1c52 
l2cap_rtx() at l2cap_rtx+0x12 0xffffffff826021a2 
r3_rtx_thread() at r3_rtx_thread+0x3c 0xffffffff82600edc 
Debugger("panic")

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>