########## DF-0733 — deterministic userspace harness (PRIMARY proof) ##########
########## BUILD ##########
harness (BUGGY) build: OK
harness_fixed (FIXED) build: OK

########## RUN: BUGGY (unpatched transcription) ##########
=== DF-0733 deterministic UAF transcription ===
MODE: BUGGY (acl_check calls _find_acl with NO lock — the bug)
bucket=5  victim=0x8004c04c0  lookup matches nothing (forces full walk)

acl_check rc=-1  uaf_read_happened=1  wild_deref=1
victim->acl_hash.le_next (read from FREED memory) = 0xdededededededede  poisoned=YES (0xde fill)

UAF CONFIRMED: _find_acl's LIST_FOREACH read victim->acl_hash.le_next
from FREED memory (poison byte 0xde repeated).  The subsequent deref of the wild pointer faulted — the
userspace analogue of the kernel panic in _find_acl/acl_check.
On a real kernel with INVARIANTS+use_malloc_pattern this wild
le_next => panic; on noinv it is a slab-groom candidate
(controlled le_next => arbitrary r/w primitive).
RESULT: UAF CONFIRMED
BUGGY_RC=0

########## RUN: FIXED (ACL_LOCK around _find_acl) ##########
=== DF-0733 deterministic UAF transcription ===
MODE: FIXED (acl_check takes ACL_LOCK around _find_acl)
bucket=5  victim=0x8004c04c0  lookup matches nothing (forces full walk)

acl_check rc=0  uaf_read_happened=0  wild_deref=0

NO UAF (serialized): ACL_LOCK in acl_check made the remover
block until the foreach completed; victim was never freed
under the cursor.  le_next read from LIVE memory.
RESULT: FIXED — UAF NOT TRIGGERED
FIXED_RC=0

########## uname ##########
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64