{
 "finding_id": "DF-2396",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "corruption",
 "confidence": "likely",
 "verdict": "No runtime race was executed: the aibs verbatim attach (which creates the sensor sysctl OIDs) wedged the harness guest (see DF-2395 pack), so the reader-vs-detach race could not be staged. The framework claim verifies cleanly in source: oid_running is read in exactly one place (kern_sysctl.c:391-398 drain loop) and grep confirms NO increment site anywhere in the kernel - the drain loop can never observe oid_running>0, so sysctl_remove_oid frees oid+arg1 storage without waiting for in-flight handlers. The aibs-side precondition (sensordev_deinstall then immediate kfree of sc_asens_* at atk0110.c:267-275) is real. fix.diff (increment/decrement+wakeup around the handler call) compile-validated in the fixed build.",
 "exploit_chain": "",
 "evidence": "VERDICT.md source analysis (oid_running read-only); race not staged (rig wedge)",
 "kernel_refs": [
  "sys/dev/acpica/aibs/atk0110.c:268",
  "sys/kern/kern_sysctl.c:391",
  "sys/kern/kern_sysctl.c:395",
  "sys/sys/sysctl.h:168"
 ],
 "poc_changes": "race staging depended on the aibs rig that wedged; framework analysis performed instead",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64",
 "runtime_sec": 120,
 "guest_dirty": 0,
 "runner": "df-bsd-reviewer",
 "build_cmd": "make -j5 nativekernel KERNCONF=ACHARNESS (see build.sh; stock-kernel findings need no build)",
 "run_cmd": "see run.sh",
 "code_hash": "cb21865e4336f2800be8cae82626093876efb27f589b4927a8ab27d7e83ed8bf",
 "notes": "",
 "recommended_fix": "see fix.diff",
 "fix_status": "compile_validated"
}