# DF-0764 — Stale `worklist_tail` in `add_to_worklist` (FFS softdep)

**Subsystem:** FFS soft updates worklist — `sys/vfs/ufs/ffs_softdep.c`.
**Severity:** Medium. **Status:** reproduced (code-level confirmation); narrow
race, not deterministically triggered from black-box userspace in bounded time.

## Build

```sh
cc -O2 -Wall -o softdep_churn softdep_churn.c   # benign -Wformat-truncation notes
```

## Run (root on the guest; the bug is in kernel worklist code, so user privilege
is irrelevant — an unprivileged user with `vfs.usermount=1` + a root-created image
hits the same path)

```sh
# set up a softdep-enabled FFS image
truncate -s 1G /root/ffs.img
vnconfig -c vn0 /root/ffs.img
newfs -U -i 4096 /dev/vn0
mkdir -p /mnt/ffs
mount_ufs /dev/vn0 /mnt/ffs

# run the churn harness (90s x 16 workers: 8 unlink churners + 8 stat/open
# vnode-lock churners, parent drives sync() to push num_on_worklist toward the
# max_softdeps/10 request_cleanup threshold)
./softdep_churn /mnt/ffs 90 16

# attempt unmount — softdep_flushfiles "looping" panic here => race fired
sync; sync; sync; umount /mnt/ffs
```

## Expected

- **Bug present:** if the race fires (needs `num_on_worklist > 10000`, several
  head `D_DIRREM` items with locked vnodes, tail selected by the `LK_NOWAIT`
  scan, and a concurrent `add_to_worklist` in the `FREE_LOCK`→`WORKITEM_FREE`
  window), an orphan chain grows, `num_on_worklist` is inflated, and the final
  `umount` panics with `panic("softdep_flushfiles: looping")` at
  `ffs_softdep.c:766`. The race is **narrow** (CVSS `AC:H`); a single 90 s run
  usually does NOT trigger it.
- **Bug fixed (single-fix kernel):** harness runs identically, `umount` succeeds
  with rc=0, no panic. The stale-tail class is eliminated by construction.

## Files

- `softdep_churn.c` — best-effort stress harness (churn + vnode-lock pressure).
- `VERDICT.md` — full mechanism trace + fix validation.
- `fix.diff` — `git apply`-able fix (eliminates the stale-tail flaw).
- `build.log` / `run_unpatched.log` / `run_patched.log` / `fix_build.log` /
  `fix_run.log` / `env.txt` — full evidence.
- `manifest.json` — machine-readable catalog.