# DF-0946 — PoC

Race in `swp_pager_meta_build` while-loop (`swap_pager.c:2385-2391`):
the loop re-reads `swap->swb_pages[index]` after a blocking call to
`swp_pager_freeswapspace` that sheds the lwkt object token, allowing
a concurrent meta_build on another CPU to insert a new swapblk into
the slot which the first thread then frees out from under the second
caller.

## Build

```
./build.sh
```

## Run

```
./run.sh
```

The stress test runs as the unprivileged user. It mmap's a 64MB
MAP_SHARED anonymous region, forks 4 children that concurrently
re-dirty the same pages, paired with a 3GB background swap-pressure
amplifier to force the pageout daemon into swap activity. Runs 200
rounds; expected to NOT trigger the race (AC:High).

## Expected

On a vulnerable kernel the race *could* panic in blist (double-free
of a swapblk) or quietly corrupt swapped data. On this guest, with
this workload, no panic is observed — see `VERDICT.md` for why (the
race window is too narrow for a userspace PoC).

The fix (`fix.diff`) is a one-line change: `while` → `if`, caching
the value to free before clearing the slot.