DF-5765 -- DECISIVE UNPATCHED RUN (run 1 of the race rig)
=========================================================

Provenance: the race script (run.sh) was executed over ssh
(`vm.sh run_root`); the guest PANICKED mid-run, so ssh died
("Connection to 127.0.0.1 closed by remote host") and the in-guest
run.log was never retrieved.  The serial-console capture below
(`vm.sh log`, saved verbatim as panic.txt) IS the runtime output of
the decisive run.  `vm.sh status` => down immediately after.

Console (verbatim):

login: [xlatrace] harness loaded: production iconv.c + iconv_xlat.c compiled in verbatim
[xlatrace] racer on cpu2 up (zz9to:zz9from)
[xlatrace] 5 racers started
[xlatrace] racer on cpu4 up (zz9to:zz9from)
[xlatrace] racer on cpu1 done
[xlatrace] racer on cpu4 done
[xlatrace] racer on cpu5 done
[xlatrace] racer on cpu3 done
[xlatrace] racer on cpu3 up (zz9to:zz9from)
panic: BADFREE2
cpuid = 2
Trace beginning at frame 0xfffff801184df698
[xlatrace] rac_ekrf roene (c)p ua4t  up (_zkzf9rteoe:+z0zx95f9r3o m0)xfffffff80658413
_kfree() at _kfree+0x593 0xffffffff80658413
iconv_sysctl_add() at iconv_sysctl_add+0x172 0xffffffff82600c12
sysctl_root.isra.5() at sysctl_root.isra.5+0x166 0xffffffff80683d06
userland_sysctl() at userland_sysctl+0x111 0xffffffff806840a1
sys___sysctl() at sys___sysctl+0x74 0xffffffff80684204
Debugger("panic")

CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

Interpretation:
- The garbled line interleaved into the panic trace is a racer kprintf
  ("[xlatrace] racer on cpu4 up (zz9to:zz9from)") colliding with the
  panic text -- racers were active on other CPUs at panic time.
- panic: BADFREE2 at _kfree+0x593 called from iconv_sysctl_add+0x172:
  the PRODUCTION kern.iconv.add error-path kfree() hit a chunk whose
  allocator freelist state was already corrupted by the racers'
  unlocked cp_refcount++ / cp_refcount-- writes into freed cspair
  memory (iconv_xlat.c:63 / :73 via iconv_open/iconv_close, which
  take no lock -- iconv.c:233-273 -- against the under-lock free at
  iconv.c:440).
- Timeline in the console: the baseline phase racers start and stop
  cleanly ("done" lines), the race phase restarts them ("racer on
  cpu3 up" after the dones), and the panic lands seconds into the
  8,000,000-iteration hammer of the production register/free churn.

Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 X86_64_GENERIC, 6 CPUs,
kernel build of 2026-07-02 (env.txt).