# DF-0949 — PoC

`sys_mlockall` use-after-free: stale `vm_map_entry` pointer held across
`vm_fault_wire()` which releases the vm_map lock. Concurrent `munmap()`
frees the entry out from under us; on resume we write to freed memory.

## Build

```
./build.sh    # builds mlockall_uaf_v4 (uses pthread)
```

## Run

```
ssh dfbsd         # root required (mlockall is SYSCAP_RESTRICTEDROOT)
cd poc/DF-0949
./run.sh
```

Spawns two pthreads: one hammering `mlockall(MCL_CURRENT)`, the other
churning `munmap`/`mmap` over 256 pre-populated single-page entries.

## Expected

- **Unpatched kernel (#0 baseline)**: panic within ~30 s with
  `panic: assertion "entry->wired_count" failed in vm_fault_unwire
  at vm_fault.c:2672`.
- **Patched kernel (#1 single-fix)**: 60-second run completes cleanly,
  no panic, no hang.

See `VERDICT.md` for the full root-cause analysis and `fix.diff` for
the validated fix (delegate to `vm_map_user_wiring`, exactly like
`sys_mlock`).