DF-0774 — devfs_clone UAF stress harness run
Guest: DragonFly 6.5-DEVELOPMENT #0 (unpatched audit-source kernel)
Run as: root (kldunload + /dev/tap 0600)

Command: cd /root/poc/DF-0774 && kldload if_tap && ./uaf_stress 12

Result: KERNEL PANIC — Fatal trap 12 page fault in tapcreate+0x11a
Guest went DOWN (DDB prompt on serial console).

malloc_uninit: 1152 bytes of 'tap' still allocated on cpu 6
Fatal user address access from kernel mode from uaf_stress at ffffffff82600afa

Fatal trap 12: page fault while in kernel mode
cpuid = 4; lapic id = 4
fault virtual address    = 0x25
fault code               = supervisor write data, page not present
instruction pointer      = 0x8:0xffffffff82600afa
stack pointer            = 0x10:0xfffff80117b033e8
frame pointer            = 0x10:0xfffff80117b03418
current process          = 923
kernel: type 12 trap, code=2

Stopped at      tapcreate+0x11a:        movl    -0x1510310(%rip),%eax
db>

Analysis:
  The crash occurs inside tapcreate(), which is called via the clone handler
  callback (tapclone) from devfs_clone() line 2341. The chandler struct was
  freed by the core thread processing DEVFS_CHANDLER_DEL during the lock-release
  window (lines 2333-2341). Because debug.use_weird_array=0 (default), freed
  memory is NOT poisoned, so chandler->nhandler retains its valid tapclone
  pointer. The callback executes but accesses module data being torn down by
  kldunload, causing the page fault.

  Race window: devfs_core.c:2333 (lockmgr LK_RELEASE) to :2341 (nhandler call)
  Free path: devfs_core.c:1598-1620 (devfs_chandler_del_worker: TAILQ_REMOVE+kfree)
  Trigger: concurrent kldunload if_tap while open("/dev/tap") is in devfs_clone