# DF-2326 -- verification verdict

## Status: not_reproduced (impact: none, confidence: likely)

NOT REPRODUCED LIVE -- hardware-gated: the free side of the race does not exist on this guest. Source defect fully confirmed: pci_token is file-static (pci_user.c:59) and its only takers in the whole tree are pci_ioctl (pci_user.c:332 gettoken / :753 reltoken) -- nm on the running kernel shows it as local d -- while pci_freecfg (pci.c:2139-2162) STAILQ_REMOVEs + kfrees pci_devinfo with no lock at all, and the PCIOCGETCONF walk (:463-553) dereferences dinfo->cfg.dev (:474), dinfo->conf fields and copyouts them. /dev/pci is 0644 (world-readable) and GETCONF needs no FWRITE, so the traversal side is unprivileged. But pci_freecfg is reachable only from CardBus hot-unplug (sys/dev/pccard/cardbus/cardbus.c:191,246) and this QEMU guest has zero CardBus bridges (pciconf: no class 0607), so the UAF cannot be triggered here by any actor. On CardBus-capable hardware the window is wide (full-list walk with per-entry copyout vs constant-time free).

## Fix validation

not_testable on this guest (no CardBus controller: the free side of the race cannot run).

## Machine verdict

See verdict.json (schema-matched to audit/persist_poc.py). Key evidence files are listed in manifest.json.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)