Wedged-state transcript (DF-5784, stock INVARIANTS kernel #0 Jul 2 2026).

Timeline: craftB.img mounted read-only; ./leakloop /mnt/h2x 1000000 started.
Within seconds the leakloop stopped making progress; the driving ssh session
had to be abandoned (600s timeout, no output -- stdout was a pipe). All of
the below is from SEPARATE root shells while the wedge persisted (~20 min).

--- ps / kill ---
$ ps -p 966 -o pid,stat,command
   PID STAT   COMMAND
   966 R2     /root/poc/df5784/leakloop /mnt/h2x 1000000

$ kill -9 966
kill: 966: Operation not permitted          # unkillable

--- serial console (dfbsd-qemu/boot.log) during the wedge ---
intr 16 on cpu1 at 40001/40000 hz, livelocked limit engaged!
intr 16 on cpu1 at 70/20000 hz, livelock removed
(kernel interrupt livelock detector fires: a CPU is saturated in-kernel)

--- chain leak (vfs.hammer2.chain_allocs is the live outstanding counter;
    lastdrop decrements it on free) ---
t0:    818
t+1m:  824
t+5m:  830
(monotone creep upward -- every xop cycle allocates another duplicate
 hammer2_chain for the same media bref; the duplicates sit at refs==0 in
 the parent's rbtree and can only be reclaimed at unmount, which hangs)

--- umount ---
$ timeout 8 umount /mnt/h2x
rc=124                                     # umount hangs (mount is stuck)

--- causality control (craftC.img: SAME patched key 0xC000000000000001 but
    keybits=0, i.e. no range wrap) on a fresh boot ---
DONE entries=200000 passes=66666 chain_allocs=803
CRAFTC_DELTA=0
umount rc=0
CRAFTC_DONE
(the odd key alone is harmless; the wrap is the trigger)