# DF-0773 — NULL deref in devfs_inode_to_vnode (vn_lock on NULL vp)

Medium severity. Local DoS requiring root (`SYSCAP_RESTRICTEDROOT`).

## Build

```
cc -o trigger trigger.c
```

## Run (must be root)

```
./trigger
```

## Expected behavior

**Vulnerable kernel (`6.5-DEVELOPMENT #0`):**
kernel panic. The process never returns from `fhstat`; ssh is torn down.
Serial console (`dfbsd-qemu/boot.log`) shows:

```
Fatal trap 12: page fault while in kernel mode
fault virtual address    = 0x0
Stopped at      lockmgr_exclusive+0x5d: orl     (%r14),%esi
db>
```

**Fixed kernel:** `fhstat` returns `-1`/`ENOENT`; the binary prints
`fhstat returned rc=-1 errno=2 (No such file or directory)` and exits 1;
guest stays up.

## How it works

1. `getfh("/dev/null")` → valid devfs fhandle (right `fh_fsid` + `fid_gen=boottime.tv_sec`).
2. Mutate `fid_ino` inside `fh.fh_fid` to an inode no devfs node has.
3. `fhstat(&fh)` → `VFS_FHTOVP(devfs)` → `devfs_vfs_fhtovp` →
   `devfs_inode_to_vnode` → `devfs_iterate_topology` returns NULL (no node
   matches) → `msg->mdv_ino.vp = NULL` → unconditional `vn_lock(NULL)` at
   `devfs_core.c:972` → `lockmgr(&vp->v_lock)` page-faults on VA 0x0 → panic.

See `VERDICT.md` for the full root-cause trace and `fix.diff` for the patch.