# DF-5839 — FIXED kernel run (fix.diff applied, kernel rebuilt & booted)
# uname: DragonFly 6.5-DEVELOPMENT #1: Tue Oct 13 23:10:23 UTC 2026 (env.txt)
#
# commands:
#   kldload /usr/obj/tmp/df5839/df5839.ko
#   sysctl -n debug.df5839.run=0
#   sysctl -n debug.df5839.run=1
#   sysctl -n debug.df5839.run=2
#
=== MODE 0 (control) ===
RC0=0                                     # clean, guest stays up
=== MODE 1 (deterministic foreign hold) ===      [0.06 real, RC1=0]
df5839: triggering mode 1
df5839: victim 0xfffff800905e1400 running on cpu1
df5839: victim 0xfffff800905e1400 exiting on cpu1
df5839: foreign hold on cached corpse 0xfffff800905e1400 from cpu0 (refs=0 freetd=0xfffff800905e1400)
df5839: spawner on cpu1 consuming gd_freetd=0xfffff800905e1400
lwkt_alloc_thread: freetd corpse 0xfffff800905e1400 still has 1 refs, dropping     <-- GUARD
df5839: child td=0xfffff8008e100700  (== victim corpse: no) victim td_refs now=0  <-- fresh td, no rebirth
# stale lwkt_rele() then hit the still-allocated leaked corpse (1 -> 0): benign.
# NO PANIC; vm.sh status: up
=== MODE 2 (window race) ===                      [RC2=0]
df5839: triggering mode 2
df5839: victim 0xfffff800905e2100 running on cpu1
df5839: mode2 attempt 0: held at refs=1 freetd=0 RUNNING=0
   # ^ hold landed in the publication window itself (freetd already
   #   published, corpse not fully switched out)
df5839: mode2: window hold; waiting exit outcome
df5839: mode 2 finished, last_result=2 refs(victim)=0
# NO PANIC; guest up through all three modes.