# DF-0762 — NULL deref in `hammer2_chain_lastdrop` no-parent retry path

**Bug:** `sys/vfs/hammer2/hammer2_chain.c` `hammer2_chain_lastdrop()` — the no-parent
`else` branch (where `parent == NULL`) has a 1→0-retry path that executes
`hammer2_spin_unex(&parent->core.spin)` (old line 654), dereferencing `NULL` and
releasing a spinlock that was never acquired in that branch. Result: kernel page-fault
panic (local DoS) when the concurrent-ref race is won on a transiently-parentless
chain during HAMMER2 topology teardown.

**Severity:** Medium (DoS only — NULL-deref at a fixed offset, no escalation path).

## Files
- `h2_churn.c` — multi-thread HAMMER2 churn harness (create/delete/rename/mkdir/sync),
  run as the unprivileged user on a mounted HAMMER2 filesystem.
- `setup_h2.sh` — root-side: creates a HAMMER2 image (`vnconfig`+`newfs_hammer2`),
  mounts it at `/h2test`, chowns to `maxx`.
- `build.sh` — `cc -O2 -pthread -o h2_churn h2_churn.c`.
- `run.sh` — runs the churn harness.
- `fix.diff` — removes the bogus `hammer2_spin_unex(&parent->core.spin)` in the
  no-parent retry branch (the only correct, minimal change).
- `VERDICT.md` — full analysis, mechanism, reachability, fix validation.
- `manifest.json` — artifact catalog.

## Reproduce
```sh
# root on guest: set up HAMMER2 image + mount + chown to maxx
ssh dfbsd '/bin/sh /root/poc/DF-0762/setup_h2.sh 2048'
# unprivileged: build + run the churn
ssh dfbsd-maxx 'cd /h2test && /root/poc/DF-0762/h2_churn 120 10 6 6'
```
**Expected (bug present):** under heavy churn the kernel may panic with a page-fault
at a low address inside `hammer2_chain_lastdrop` (serial console / `dfbsd-qemu/boot.log`).
The race is narrow; the bug itself is a static certainty at
`sys/vfs/hammer2/hammer2_chain.c:654` (`parent` is unconditionally `NULL` in the
`else` branch).

**Preconditions (acceptable mount-threat-model):** a HAMMER2 filesystem image mounted
by root (mount is root-only), made usable by the unprivileged user. The trigger
itself (churn) is entirely unprivileged.

## Impact ceiling
NULL-deref at a fixed low offset → **pure DoS (panic)**. No attacker-controlled write
content, no pivot — **no privilege-escalation chain** is derivable.