DF-5765 -- SECOND UNPATCHED REPRODUCTION (run 2, fresh `vm.sh reset with-src`)
=============================================================================

Same rig, fresh guest (reset + rebuild + rerun).  Again the guest
panicked mid-race and ssh died; serial-console capture (also saved as
panic.2.txt):

login: [xlatrace] harness loaded: production iconv.c + iconv_xlat.c compiled in verbatim
[xlatrace] 5 racers started
[xlatrace] racer on cpu3 up (zz9to:zz9from)
[xlatrace] racer on cpu1 done
[xlatrace] racer on cpu4 done
[xlatrace] racer on cpu5 done
[xlatrace] 5 racers started
[xlatrace] racer on cpu2 up (zz9to:zz9from)
[xlatrace] racer on cpu4 up (zz9to:zz9from)
[xlatracep]a nPiRcO:O FB:A DlFiRvEeE 2h a n c d l e ... (interleaved PROOF + panic text)
...d_csp=0xfffff8011820f... refcount=-204 ... pair freed/reused under th_ek forpeeen( )( da_tt able_=0fxrfefef+f0fx8509038 f08xcfff9f0f0)f
_kfree() at _kfree+0x593 0xffffffff80658413
_kfree() at _kfree+0x593 0xffffffff80658413
iconv_sysctl_add() at iconv_sysctl_add+0x172 0xffffffff82600c12
sysctl_root.isra.5() at sysctl_root.isra.5+0x166 0xffffffff80683d06
userland_sysctl() at userland_sysctl+0x111 0xffffffff806840a1
sys___sysctl() at sys___sysctl+0x74 0xffffffff80684204
Debugger("panic")
CPU5 stopping CPUs: 0x0000001f
 stopped
db>

De-interleaving the console collision gives TWO simultaneous lines:

  [xlatrace] PROOF: live handle d_csp=0xfffff8011820f... refcount=-204
                  -- pair freed/reused under the open (d_table=0xfffff900f8...)
  panic: BADFREE2
  cpuid = 5
  Trace beginning at frame 0xfffff8011820698

i.e. this run shows BOTH the dangling-handoff probe firing (a live
converter handle whose cspair was freed/reused under it, refcount far
below the >=1 a correct open guarantees) AND the allocator-corruption
panic from the production sysctl error path, on the same frame.

Result: 2/2 unpatched full-race runs panicked with the identical
signature (BADFREE2, _kfree+0x593 <- iconv_sysctl_add+0x172).