DF-0774 — Patched kernel run
Guest: DragonFly 6.5-DEVELOPMENT #1 (with fix.diff applied: devfs_core.c + if_tap.c)
Run as: root
Command: cd /root/poc/DF-0774 && kldload if_tap && ./uaf_stress 12

Result: KERNEL PANIC — same crash at tapcreate+0x11a (module-data teardown race)

The fix correctly copies chandler->nhandler into a local (clone_fn) while
the lock is held (devfs_core.c:2326), preventing the chandler struct UAF.
However, the PoC still crashes because the MODULE DATA teardown race remains:
tapclone() accesses tap module globals (DEVFS_CLONE_BITMAP, tap_ops) that
kldunload is concurrently freeing via destroy_autoclone_dev().

The chandler struct UAF (the specific DF-0774 claim) IS addressed — the freed
chandler's nhandler is never dereferenced post-fix. The remaining crash is a
related but distinct module-lifecycle race requiring module reference counting
to fully close.

Additional observation: with debug.use_weird_array=1 (slab poisoning enabled),
the unpatched kernel does NOT crash — poisoning corrupts the freed chandler's
namlen field, causing the name-length check to fail, so the handler is skipped.
This confirms the chandler UAF exists: without poisoning the match succeeds
and the callback runs into the module-data race; with poisoning the match
fails entirely.