==== DF-0923 FIX VALIDATION (Phase 8) ====

Kernel under test (patched): DragonFly 6.5-DEVELOPMENT #1: Tue Jul  7 12:07:42 UTC 2026
    root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC
sha256(/boot/kernel/kernel) = db4fb5345a9e7f04dac68c61c10a9d9acdd0b8109c77dd3b37a2ef57c0b4dff6

--------------------------------------------------------------------------------
BEFORE  (unpatched baseline #0, Thu Jul  2 06:02:54 UTC 2026):
  PoC:   ./race_map 25 4   (small 4 KB read buffer, 4 readers, victim exec-loop)
  Result: KERNEL PANIC within ~seconds, every run. Identical signature both runs:
    Fatal trap 12: page fault while in kernel mode
    fault virtual address = 0x8
    instruction pointer  = 0xffffffff809a2540
    current process      = <reader pid>      (a race_map reader)
    Stopped at vm_map_rb_tree_RB_NEXT: movq 0x8(%rdi),%rax
  => the UAF: RB_FOREACH in procfs_domap advancing through a freed vm_map.
  Guest down both runs.

--------------------------------------------------------------------------------
AFTER   (single-fix kernel #1, built from the SAME source + fix.diff only):
  PoC:   SAME ./race_map (small 4 KB read buffer)

  Run 1: ./race_map 90 6
    [parent] victim pid=853, spawning 6 readers, racing 90s
    [parent] survived 90s without panic; tearing down
    [parent] done (no panic observed this run)
    RUN_EXIT=0   (ssh channel lived; clean exit)
    guest status after run: up
    boot.log panic grep: (empty)

  Run 2: ./race_map 60 8   (heavier: 8 readers)
    [parent] victim pid=869, spawning 8 readers, racing 60s
    [parent] survived 60s without panic; tearing down
    [parent] done (no panic observed this run)
    RUN_EXIT=0
    guest status after run: up
    boot.log panic grep: (empty)

--------------------------------------------------------------------------------
VERDICT: fix_status = fixed.
  The UAF panic (vm_map_rb_tree_RB_NEXT) reproduces deterministically on the
  unpatched #0 baseline and does NOT occur on the single-fix #1 kernel under
  equal-or-heavier racing (90 s/6 readers and 60 s/8 readers, both clean).
  => fix.diff closes DF-0923.

INTERMEDIATE fix attempts (documented for completeness):
  v1: vmspace_hold/drop added but released p_token mid-fn -> violated lwkt
      LIFO token order -> panic "lwkt_reltoken: illegal release". Rebuilt.
  v2: kept p_token held (LIFO-correct) but placed EFAULT checks AFTER sbuf_new
      -> leaked the sbuf on every P_INEXEC/P_WEXIT hit -> panic
      "sbuf: malloc limit exceeded". Rebuilt.
  v3 (final): EFAULT checks moved BEFORE sbuf_new; sbuf_new failure path does
      vmspace_drop. All return paths balanced. Clean. (This is fix.diff.)