DF-0925 — Guest Environment
============================

Kernel: DragonFly 6.5-DEVELOPMENT #0 (unpatched baseline, X86_64_GENERIC)
Compiler: gcc 8.3 (DragonFly)
FUSE: module-only (kldload fuse), /dev/fuse root:operator 0660
vfs.usermount: 0 (unprivileged users cannot mount FUSE)

Hardening status (relevant to exploitation):
- SMAP: OFF
- SMEP: OFF
- KASLR: OFF
- INVARIANTS: ON (X86_64_GENERIC default; fuse.h also forces INVARIANTS)
- PTI: OFF

FUSE module details:
- fuse.ko at /boot/kernel/fuse.ko (ABI 7.28)
- Dedicated objcache for fuse_node (M_FUSE_NODE, ~232 bytes)
- INVARIANTS forced by fuse.h:31-33 (#ifndef INVARIANTS / #define INVARIANTS)

Reproduction specifics:
- The natural race window is ~20ns (between mtx_unlock(ino_lock) at
  fuse_node.c:112 and the first fnp dereference in fuse_node_vn:128).
- Diagnostic tsleep(2*hz) delays were added in:
  1. vclean() (vfs_subr.c) for VT_FUSE vnodes, between cache_inval_vp
     and VOP_RECLAIM — gives concurrent nresolve time to find fnp.
  2. fuse_vop_reclaim() (fuse_vnops.c) after fuse_node_free — allows
     the freed objcache slot to be reused/zeroed.
- These delays DO NOT change code logic; they only widen timing windows
  that already exist, making the race reliably observable.