# DF-0952 — PoC

`sys_vmspace_destroy` leaks `ve->refs` on EBUSY: the +1 ref added by
`vkernel_find_vmspace` is never dropped when `vmspace_entry_delete`
returns EBUSY. Each failed destroy permanently inflates refs, eventually
triggering `panic("rb_vmspace_delete: invalid refs N")` at proc exit.

## Build

```
./build.sh
```

## Run

```
ssh dfbsd         # root required to set vm.vkernel_enable=1
cd poc/DF-0952
./run.sh
```

## Expected

The PoC confirms the API surface is reachable (vmspace_create succeeds,
uncontended destroy succeeds). It does NOT trigger the panic end-to-end
because EBUSY requires a concurrent `sys_vmspace_ctl(RUN)` holder with
a valid sanitized trapframe — heavy vkernel setup beyond a single-shooter
PoC. See `VERDICT.md` for the full source-trace analysis.

The fix (`fix.diff`) is a one-line obvious correctness fix: add
`else vmspace_entry_drop(ve);` to the EBUSY branch.