# DF-2233 — PoC evidence pack

**Finding:** Lockless list traversal in `iconv_open`/`iconv_lookupcs`/
`iconv_lookupconv` allows use-after-free via concurrent module unload.
**File:** `sys/libiconv/iconv.c` (walks at :150, :167, :243, :251-258;
lockless sysctl_add lookup at :418; frees at :133-143, :218-225, :80-98).
**Verdict:** REPRODUCED — kernel panic (UAF read on freed converter class),
twice, stock modules, < 45 s per run. See `VERDICT.md`, `panic.txt`,
`panic.2.txt`, `run.log`.

## Build

On the host, from this directory (guest booted via `dfbsd-qemu/vm.sh`):

    ../../../../findings/poc/pushrig.sh        # or: scp -F ... the 3 files + guest make

On the guest (root):

    sh /root/rig2233/../build.sh    # i.e.: cd /root/rig2233 && make; cc churnadd.c

`race2233.ko` = pristine `/usr/src/sys/libiconv` sources + `race2233_harness.c`
(walk hammer). `churnadd` = userland walk/free driver.

## Run (baseline — expect panic)

    sh run.sh                       # on the guest, as root
    # host: dfbsd-qemu/vm.sh log    # capture: Stopped at iconv_lookupconv+0x30

Expected decisive output (see panic.txt):

    Fatal trap 12: page fault while in kernel mode
    fault virtual address  = 0x800
    Stopped at      iconv_lookupconv+0x30:  movq    0x800(%rsi),%rdi

## Fix validation

    cd /usr/src && patch -p1 < fix.diff
    (rebuild race2233.ko / a libiconv variant from the patched tree)
    rerun the soaks -- see fixvalidation.log (baseline signature never
    reappears; residual kldunload-drain micro-race documented there).

## Files

    Makefile               kmod makefile (bundles pristine libiconv + harness)
    race2233_harness.c     in-kernel iconv_open walk hammer (sysctl-driven)
    churnadd.c             userland: walk (EINVAL probe) / bad (register+free)
    build.sh, run.sh       exact commands
    build.log              full module build output
    run.log                full run narrative + outputs
    panic.txt, panic.2.txt serial console panic captures (two boots)
    env.txt                guest environment
    fix.diff               validated fix (traversal lock + drain guard)
    fixvalidation.log      A/B fix validation outputs
    manifest.json          machine catalog
    verdict.json           machine verdict