## DF-0733 — Phase 8 fix validation (patched wlan_acl.ko) ##

# Baseline (unpatched /boot/kernel/wlan_acl.ko, INVARIANTS ON, use_malloc_pattern=1):
#   harness ran with the lockless acl_check against concurrent iac_remove/_acl_free:
#   df0733: harness unloaded (adds=6478455 removes=8685618 checks=1741115)
#   => 1,741,115 lockless acl_check calls vs 8,685,618 _acl_free ops.
#   Guest stayed up (UAF read is silent on INVARIANTS-on: freed le_next resolves
#   to a mapped slab free-list pointer; the decisive before/after is the
#   deterministic userspace harness, run.log).

# Patched wlan_acl.ko (acl_check now takes ACL_LOCK around _find_acl):
SHA256 (wlan_acl.ko) = 10a0f6c46ad082eb664e74a1c3dc3079851c44af7ef9ba8ddce3fd4a53019463
SHA256 (/boot/kernel/wlan_acl.ko unpatched) = e1cf6dd4fd9d53c3b1975dd3996c1ef69d80998c9c6a8d3f75175f8aa9e31b9a

# Disassembly of patched acl_check confirms the lock is now taken:
#   0000000000000770 <acl_check>:
#   ...
#    79d:  be 02 00 00 00        mov    $0x2,%esi        ; LK_EXCLUSIVE
#    7a2:  4c 89 ef              mov    %r13,%rdi        ; &as->as_lock
#    7a5:  ...
#    7aa:  e8 00 00 00 00        callq  ...              ; lockmgr_exclusive (ACL_LOCK)
#   ...    <_find_acl inlined: LIST_FOREACH over as_hash[hash]> ...
#    7fb:  4c 89 ef              mov    %r13,%rdi
#    7fe:  e8 00 00 00 00        callq  ...              ; lockmgr_release (ACL_UNLOCK)
#   nm wlan_acl.ko:
#                    U lockmgr_exclusive
#                    U lockmgr_release

# Re-run trigger on patched module (harness_mod.ko + /dev/df0733, 8 threads, 35s):
TRIGGER_EXIT=124 (inner timeout — ran the full window)
vm status after run: up   (no panic, no slab corruption)

# Module unload final counts on PATCHED wlan_acl.ko:
df0733: harness unloaded (adds=2803330 removes=5104190 checks=673611)
# 673,611 serialized acl_check calls vs 5,104,190 _acl_free ops concurrently;
# with ACL_LOCK now held by acl_check, the foreach and _acl_free are mutually
# exclusive — the race is closed.  Guest stayed up.

# Deterministic userspace harness on the patched transcription (FIXED mode):
#   MODE: FIXED (acl_check takes ACL_LOCK around _find_acl)
#   acl_check rc=0  uaf_read_happened=0  wild_deref=0
#   NO UAF (serialized): ACL_LOCK made the remover block until the foreach
#   completed; victim was never freed under the cursor.
#   RESULT: FIXED — UAF NOT TRIGGERED

CONCLUSION: fix closes the UAF.  Before = "UAF CONFIRMED" (poison le_next read
0xdededededededede from freed memory + wild deref).  After = "NO UAF (serialized)".
fix_status: fixed.