OK, I'm up and running with p9, but... this is pretty wacky (at least when viewed through the lens of my not-all-that-great understanding of all of this stuff):
While booted in BE "default", which was running p7, I fetched and installed p9. Verified (with freebsd-version) that installed and userland were p9, while running was p7. I then rebooted (not having done anything further, such as copying loader.conf around or modifying the cpu microcode stuff). I got the same freezing problem. That was mostly expected, but I wanted to explicitly verify or refute it.
I then booted to BE "15.0-RELEASE-p7_2026-05-24_225844", which had just been created by the freebsd-update that I did. My intent was to use it to check if the copies of loader.conf had in fact been removed (as at least kind of expected), and, if so, copy them back in. But I couldn't get that far... because I got the same boot freeze using "15.0-RELEASE-p7_2026-05-24_225844".
That was totally unexpected (by me, at least). I had expected "15.0-RELEASE-p7_2026-05-24_225844" to be an exact duplicate of "default" from immediately before having done the freebsd-update. And that "default" BE had rebooted just fine a few days ago, and I'd been using it ever since. Plus, as mentioned earlier in this thread, I had verified that the copies of loader.conf were present in it, and that they were in fact bytewise equal to /boot/loader.conf. So, I had fully expected that they would still be present in "15.0-RELEASE-p7_2026-05-24_225844" even if today's freebsd-update had removed them from "default".
Note before continuing: To be explicit, all wackiness is above this point; everything below went as I was expecting or at least largely expecting.
So, I rebooted again, this time to BE "15.0-RELEASE-p6_2026-04-29_193148", hoping I could use that one to fix "default".
The reboot worked, and I saw that the copies of loader.conf had in fact been deleted from "default". I copied the version of loader.conf from "default" to its other expected locations within "default".
Rebooted again, into "default". Freeze again. Largely but not entirely expected, as I intentionally had not removed the cpu microcode stuff that users in the Bugzilla thread had found problematic.
Rebooted again, into the p6 BE. Removed the cpu microcode stuff from "default" (to be explicit, only those two lines mentioned in the earlier comment; there was also cpuctl_load="YES", which I did not remove).
Rebooted again, into "default". No freeze. Verified that p9 is everywhere (installed, running, userland).