# DF-0774 — devfs_clone Use-After-Free

## Finding
Use-after-free in `devfs_clone()` (`sys/vfs/devfs/devfs_core.c:2314–2351`):
clone handler freed during lock-release window before `nhandler` callback.

## Build
```sh
cc -O2 -o uaf_stress uaf_stress.c
```

## Run
```sh
# MUST run as root: /dev/tap is 0600, kldunload requires root
kldload if_tap
./uaf_stress 15
```

## Expected behavior (bug present)
Kernel panic — `Fatal trap 12: page fault` in `tapcreate+0x11a`.
Guest goes down (DDB on serial console).
Reproduces within ~12 seconds of stress.

## Preconditions
- **Root** access (for kldunload + /dev/tap open)
- OR physical device removal of a USB autoclone device (e.g. /dev/dsp)
- Unprivileged users CANNOT trigger this on a default guest

## Files
- `uaf_stress.c` — concurrent open/kldunload stress harness
- `build.sh` / `run.sh` — exact build/run commands
- `fix.diff` — git-apply-able fix (devfs_core.c + if_tap.c)
- `VERDICT.md` — full analysis
- `panic.txt` — kernel panic signature from serial console
- `run.log` — unpatched kernel run output
- `fix_run.log` — patched kernel run output
- `fix_build.log` — patched kernel build log
- `env.txt` — guest environment