# DF-2396 VERDICT

**Status:** not_reproduced
**Impact:** corruption
**Confidence:** likely
**Attempts:** 1

No runtime race was executed: the aibs verbatim attach (which creates the sensor sysctl OIDs) wedged the harness guest (see DF-2395 pack), so the reader-vs-detach race could not be staged. The framework claim verifies cleanly in source: oid_running is read in exactly one place (kern_sysctl.c:391-398 drain loop) and grep confirms NO increment site anywhere in the kernel - the drain loop can never observe oid_running>0, so sysctl_remove_oid frees oid+arg1 storage without waiting for in-flight handlers. The aibs-side precondition (sensordev_deinstall then immediate kfree of sc_asens_* at atk0110.c:267-275) is real. fix.diff (increment/decrement+wakeup around the handler call) compile-validated in the fixed build.

## Kernel references
- `sys/dev/acpica/aibs/atk0110.c:268`
- `sys/kern/kern_sysctl.c:391`
- `sys/kern/kern_sysctl.c:395`
- `sys/sys/sysctl.h:168`

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64

## Fix validation
See fix.diff and README.md for the baseline/fixed A/B outputs (run.log / fixed.log).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.