DF-5846 run logs — FIXED kernel (tri-fix build #2: Mon Oct 26 06:04:19 UTC
2026 = DF-5846 NULL guard + DF-5847 nd6 fix + DF-5848 m_dup_data fix),
full-mix storm 0xf, 2026-10-26.

RUN 1 (150 s budget, /tmp/f1.out — console-captured; see also
panic-fixedrun-hammer2-incidental.txt):
  vfs_nlookup: '..' traverse disconnected: pid 833 (df5846_storm)
  vfs_nlookup: '..' traverse disconnected: pid 833 (df5846_storm)
  -> the DF-5846 guard fired TWICE; each firing is a walk that on STOCK
     is the instant kernel panic (stock 4/4). The nlookup crash NEVER
     appeared. ~2.5 minutes into the run the guest died at a DIFFERENT
     site: hammer2_xop_start_except+0x25 (NULL+0x81554 read) — a
     separate, pre-existing hammer2 bug (see attribution below).

RUN 2 (150 s budget, console = run-fixed3-console.txt):
  46 x "vfs_nlookup: '..' traverse disconnected: pid 1024 (df5846_storm)"
  -> FORTY-SIX would-be stock panics handled gracefully in one run;
     zero nlookup faults; guest eventually died at the same separate
     hammer2_xop_start_except site.

ATTRIBUTION of the hammer2 crash (NOT DF-5846, NOT guard-related):
  - fixed kernel, mode 0xd (fchdir-swap + dance + readers; NO long
    cross-mount ".." walks): guard fired 0 times, yet the identical
    hammer2_xop_start_except+0x25 crash occurred (boot log saved as
    stock-hammer2-attribution-run.txt companion run on FIXED kernel).
  - PRISTINE STOCK kernel (#0 Jul 2), mode 0xd, 300 s budget
    (stock-hammer2-attribution-run.txt): guard does not exist in stock;
    the identical crash occurred (Fatal user address access ... at
    hammer2_xop_start_except+0x25, fault VA 0x81554).
  => The hammer2_xop_start_except crash is a pre-existing storm bug,
     reachable on stock, independent of all three fixes in this batch.
     It deserves its own finding (unprivileged; NULL-based read in the
     hammer2 xop dispatch machinery under cross-mount fchdir churn).