# DF-1365 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** speculative

## Finding
fd_detach does not stop fd->tohandle callout (UAF on detach race)

## Source Location
sys/dev/disk/fd/fd.c:1090-1980

## Verdict
Source-confirmed: fd_detach does not stop fd->tohandle callout (UAF on detach race). Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
fd_detach at fd.c:1090-1091: stops toffhandle and motor but NOT tohandle. tohandle armed during SEEKCOMPLETE (:1970/:1980), stopped in IOCOMPLETE (:1991). kldunload during active I/O -> callout fires after softc freed -> UAF. Fix: add callout_stop(&fd->tohandle) in detach.