# DF-5839 — decisive baseline run (stock INVARIANTS X86_64_GENERIC)
# guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 (env.txt)
#
# command sequence (root):
#   kldload /usr/obj/tmp/df5839/df5839.ko
#   sysctl -n debug.df5839.run=0        # x3 control runs (clean, no panic)
#   sysctl -n debug.df5839.run=1        # deterministic foreign-hold trigger
#
# --- dmesg after the trigger (ssh session) ---
df5839: loaded (watcher=cpu0 0xfffff8008ed9d480, spawner=cpu1 0xfffff8008dc57300)
df5839: triggering mode 0
df5839: mode 0 finished, last_result=0 refs(victim)=-9
df5839: triggering mode 0
df5839: mode 0 finished, last_result=0 refs(victim)=-9
df5839: triggering mode 0
df5839: mode 0 finished, last_result=0 refs(victim)=-9
df5839: triggering mode 1
df5839: victim 0xfffff800905fee80 running on cpu1
df5839: mode 1 finished, last_result=-99 refs(victim)=0
df5839: foreign hold on cached corpse 0xfffff800905fee80 from cpu0 (refs=0 freetd=0xfffff800905fee80)
df5839: spawner on cpu1 consuming gd_freetd=0xfffff800905fee80
df5839: child td=0xfffff800905fee80  (== victim corpse: YES)
# (ssh session dies here — guest panics; serial console continues:)
df5839: child 0xfffff800905fee80 (reborn corpse) running on cpu5 refs=0
panic: assertion "td->td_refs > 0" failed in lwkt_rele at /usr/src/sys/kern/lwkt_thread.c:505
cpuid = 0
Trace beginning at frame 0xfffff80118317a40
rebirth_and_rele() at rebirth_and_rele+0xe6 0xffffffff82600316
watcher_func() at watcher_func+0x515 0xffffffff82600895
Debugger("panic")
CPU0 stopping CPUs: 0x0000003e
db>
# raw (interleaved) serial capture in panic.txt / console-full.log