=== DF-0033 fix.diff VALIDATION (Phase 8) — before/after ===

BUG CLASS: race-condition UAF -> kernel panic (KKASSERT at kern_descrip.c:2627)
TRIGGER:  ./fdtol_race <secs> <peers>  as unprivileged maxx (uid 1001)

--------------------------------------------------------------------------------
BEFORE (unpatched INVARIANTS #0 baseline, kern.version "Thu Jul 2 06:02:54"):
--------------------------------------------------------------------------------
$ ./fdtol_race 25 12
[*] DF-0033 v2: 12 peers x 25 secs, hammering rfork(RFPROC|RFTHREAD)
    ++ under p_token (kern_fork.c:569)  vs
    -- under fd_spin  (kern_descrip.c:2675)
<GUEST PANICKED ~25s in>
panic with 1 spinlocks held
panic: filedesc_to_refcount botch: fdl_refcount=-1925828443
Debugger("panic")
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
Trace: fdfree <- fdfree <- exit1 <- sys_exit <- syscall2
=> ssh dies; vm.sh status => down.  BAD BEHAVIOR present.

--------------------------------------------------------------------------------
AFTER (single-fix INVARIANTS #1, kern.version "Fri Jul 3 21:13:20",
       fix.diff = spin_lock(&p1->p_fd->fd_spin) around fdl_refcount++ AND
       filedesc_to_leader_alloc() in kern_fork.c:563-576):
--------------------------------------------------------------------------------
$ ./fdtol_race 25 12
[*] DF-0033 v2: 12 peers x 25 secs, hammering rfork(RFPROC|RFTHREAD)
    ++ under p_token (kern_fork.c:569)  vs
    -- under fd_spin  (kern_descrip.c:2675)
[+] DF-0033 v2: completed without panic.
$ echo RC=$?   -> 0
=> vm.sh status => up.  NO panic, NO botch, guest healthy.

Repeated across ~130 s of cumulative stress (25 s + 30 s + 40 s + 35 s runs,
12 peers each) with ZERO fdtol-signature panics on the fixed #1 kernel, vs a
panic within ~25 s on the unpatched #0 baseline.

--------------------------------------------------------------------------------
VERDICT: fix.diff CLOSES THE BUG.
--------------------------------------------------------------------------------
The `spin_lock(&fd_spin)` serializes the increment with fdfree()'s decrement
(both now under the shared fd-table spinlock), eliminating the lost-update race
-> fdl_refcount can no longer drift below the true count -> no premature
kfree(fdtol) -> no UAF -> no botch panic.  fix_status = fixed.

fix kernel kern.version: DragonFly 6.5-DEVELOPMENT #1: Fri Jul  3 21:13:20 UTC 2026
fix kernel /boot/kernel/kernel sha256: 60d6ff57e1682a232675b2ade1fe52c6dfdbce978d94c49706f303a8596104c2
baseline kernel sha256 (unpatched #0): (audit #0, "Thu Jul 2 06:02:54")
fix_build.log: === FIX_BUILD_DONE rc=0 ===  (single-fix nativekernel built clean)