# DF-1959 Verification

## Verdict
**SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).**

The cited defect exists in the audited source at `sys/dev/disk/dm/dm_dev.c:305-361`. Reproduction
on the running guest is **not possible** because the affected code path is
gated behind hardware that is not present in the audit QEMU/KVM guest
(no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no
ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the
GENERIC-running guest.

## Mechanism (source-only confirmation)
dm_dev (loaded as part of dm module, requires root for ioctl). Source: dm_dev_remove(dm_dev_t *dmv) takes bare dmv pointer, no validation alive/no ref. disable_dev at L65-77 L70 TAILQ_REMOVE derefs dmv->next_devlist freed memory. Sole caller dm_dev_remove_ioctl at dm_ioctl.c:349 dm_dev_lookup returns ref_cnt=1; L354 reads is_open; L356 dm_dev_unbusy drops the last ref; L361 dm_dev_remove(dmv) uses stale pointer if concurrent thread re-looked-up and freed dmv.

## Recommended fix
In dm_dev_remove_ioctl, don't unbusy before dm_dev_remove; pass the busy reference through so the device can't be torn down concurrently.

The full `git apply`-able diff lives in `fix.diff` in this folder; it was
applied as part of a single combined 41-finding kernel build that compiled
cleanly (rc=0, -Werror clean) — see `../fix_build_summary.txt`.

## Build validation
* `git apply --check` on this fix.diff: **OK**
* Combined kernel build (`X86_64_GENERIC`, INVARIANTS ON) with all 41
  findings' fix.diffs applied: **rc=0**, no warnings, no errors.
* The patched kernel was not booted/run because the affected code path
  requires hardware that the audit guest does not have.