+ ./harness buggy
[*] DF-0884 harness: mode=BUGGY
[*] Thread A: read(2) on VDIR at offset 0 (will block in smbfs_findnext)
[*] Thread B: read(2) on VDIR at offset 0 (will reopen -> findclose A's ctx)
[*] Thread A is now blocked inside smbfs_findnext() holding ctx (== n_dirseq)
[*]   n_dirseq=0x8005108c0 n_dirofs=2
[*] After Thread B ran: A's ctx=0x8005108c0 freed? YES (poison=0xDD)
[*] Releasing Thread A from smbfs_findnext() -- it will now write ctx->f_attr.fa_ino THROUGH FREED MEMORY
[*] Thread A rc=0  Thread B rc=0
[+] A wrote ctx->f_attr.fa_ino (0xcafebabe) into an object that was ALREADY freed by Thread B's smbfs_findclose()
>>> UAF CONFIRMED: smbfs_findnext wrote through freed smbfs_fctx (dead-code lock upgrade lets two read(2) on a VDIR run smbfs_readvdir concurrently)
RUN_EXIT=0