# DF-1912 PoC

Trigger: race `mdstrategy_preload` to get two bios co-resident in the
`bio_queue`, causing the stale-bp UAF on the second iteration.

## Preconditions

* `options MD_ROOT` kernel with md0 mounted (MFS root / installer / embedded).
* Any local user with read access to `/dev/md0`.

## Build

```
cc -O2 -pthread race.c -o race
```

## Run

```
./race /dev/md0
```

## Expected output

```
panic: md: bad cmd %d <garbage>     # stale b_cmd after buf recycled
OR random fs corruption on the mfs root
OR OOB-write panic when bio_offset + bp->b_bcount exceeds pl_len
```

The race window opens whenever two preads land in `mdstrategy_preload`'s
`bio_queue` at once; because `biodone` (md.c:395) runs outside the crit
(md.c:373) and the woken fs thread re-enters `mdstrategy` on the same CPU,
the loop's second iteration dereferences the stale bp.

## Fix

See the finding markdown: add `bp = bio->bio_buf;` after
`bio = bioq_takefirst(&sc->bio_queue);` at md.c:372.