BUILD_EXIT=0
DF-2000 source-confirmation (ic(4) UAF race)
============================================
[1] SIOCSIFMTU handler (if_ic.c:205-223) swaps ic_ifbuf/ic_obuf
    and kfrees the old buffers with NO driver-level lock taken
    inside icioctl itself. -> PASS (race source confirmed)
[2] icoutput (if_ic.c:335-408) dereferences sc->ic_obuf at lines
    358,360,370 and reads it in iicbus_block_write (line 390),
    guarded ONLY by crit_enter() (line 349) which is per-CPU.
    -> PASS (stale-pointer window confirmed)
[3] icintr (if_ic.c:253-330) captures sc->ic_cp = sc->ic_ifbuf
    (line 267) and writes *sc->ic_cp++ (line 309) under crit_enter
    ONLY (line 261). -> PASS (stale-pointer window confirmed)
[4] ifioctl wraps SIOCSIFMTU in ifnet_serialize_all (if.c:2276),
    but icattach passes NULL serializer (if_ic.c:146) and neither
    icoutput nor icintr acquires ifp->if_serializer.
    -> PASS (no mutual exclusion between paths)

Verdict: a concurrent SIOCSIFMTU on CPU B can kfree the buffer
that icoutput/icintr on CPU A dereferences -> kernel heap UAF write.
HW-gated: requires ic(4) parallel-port i2c interface (not on guest).

ALL_PROPERTIES=CONFIRMED
RUN_EXIT=0