# DF-2399 VERDICT

**Status:** reproduced (reproduced)
**Impact:** corruption
**Confidence:** certain
**Attempts:** 2

Through the VERBATIM agp_open/agp_close: two opens produced ONE device_busy (busy stayed 1 after openB), and the FIRST close freed ALL AGP memory on the list (including the second openers allocation), released the acquire state and called device_unbusy (busy 0, isopen 0) while the second fd still had the device open - cross-process memory wipe plus a busy-count mismatch that lets detach proceed during active use (dangling si_drv1). Second close was a no-op (guard `if (sc->as_isopen)`). Fixed kernel: isopen counts 2 opens, closeA leaves isopen=1/busy=1 with the memory list INTACT, cleanup only at closeB.

## Kernel references
- `sys/dev/agp/agp.c:781`
- `sys/dev/agp/agp.c:793`
- `sys/dev/agp/agp.c:807`
- `sys/dev/agp/agp.c:809`

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64

## Fix validation
See fix.diff and README.md for the baseline/fixed A/B outputs (run.log / fixed.log).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.