{
 "finding_id": "DF-2347",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "The REAL in-kernel usbpf_xfertap called lockless exactly as the DONE path does, against a fabricated bus whose ifp a second thread clears in a loop (what usbpf_clone_destroy does at usb_pf.c:191 before if_free): the tap races its :362 NULL-check against its :488 bpf_tap(bus->ifp->if_bpf,...) use and the kernel panics at usbpf_xfertap+0x447 reading offset 0x60 (if_bpf) through the NULL ifp - fault virtual address 0x60, exactly the predicted second-read TOCTOU. With the ifp-captured-once fix, 200,000 taps against 193 million NULL stores complete without a panic. Destroy is gated by SIOCIFDESTROY/clone-destroy (root), so the demonstrated race is a privileged-trigger local DoS; the residual if_free UAF window is documented for upstream.",
 "exploit_chain": "",
 "evidence": "panic.txt (fault 0x60 at usbpf_xfertap+0x447 movq 0x60(%rax)), run_fixed_kernel.log (survived: taps=200000 null_stores=193087519), rig/dfbatch_usbpf.c, fix.diff",
 "kernel_refs": [
  "sys/bus/u4b/usb_pf.c:362",
  "sys/bus/u4b/usb_pf.c:488",
  "sys/bus/u4b/usb_pf.c:191"
 ],
 "poc_changes": "fabricated xfer widened to 255 zero-length frames so the window is the honest production width; bdev taken from the real global device list so device_get_unit works",
 "attempts": 5,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #5 DFBATCH Wed Oct 21 21:27:34 UTC 2026 root:/usr/obj/usr/src/sys/DFBATCH x86_64 (rig kernel); stock baseline #0 X86_64_GENERIC",
 "runtime_sec": 720,
 "guest_dirty": 0,
 "build_cmd": "kernel-compiled rig (DFBATCH)",
 "run_cmd": "sysctl debug.dfbatch.cmd=\"usbpf <control|race>\"",
 "code_hash": "f839ffa08e51107fb535e875f3fc37e2933e794c07dec3462eaa155b955fd207",
 "notes": "fix validated A/B on the same rig: baseline behavior gone post-patch (see run_fixed* logs); rig kernel = X86_64_GENERIC + device dfbatch, INVARIANTS kept",
 "recommended_fix": "read bus->ifp once at the sanity check and use the captured pointer at bpf_tap"
}