{
 "finding_id": "DF-2399",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "corruption",
 "confidence": "certain",
 "verdict": "Through the VERBATIM agp_open/agp_close: two opens produced ONE device_busy (busy stayed 1 after openB), and the FIRST close freed ALL AGP memory on the list (including the second openers allocation), released the acquire state and called device_unbusy (busy 0, isopen 0) while the second fd still had the device open - cross-process memory wipe plus a busy-count mismatch that lets detach proceed during active use (dangling si_drv1). Second close was a no-op (guard `if (sc->as_isopen)`). Fixed kernel: isopen counts 2 opens, closeA leaves isopen=1/busy=1 with the memory list INTACT, cleanup only at closeB.",
 "exploit_chain": "second process AGP memory silently freed + device detach allowed while an fd holds it -> UAF on the agp softc through /dev/agpgart on real AGP hardware (root-gated device)",
 "evidence": "run.log (openA busy=1; openB busy=1; closeA isopen=0 busy=0 memory list EMPTY state released while B open); fixed.log (openA/B isopen=2; closeA isopen=1 busy=1 memory NOT empty state kept; closeB isopen=0 busy=0)",
 "kernel_refs": [
  "sys/dev/agp/agp.c:781",
  "sys/dev/agp/agp.c:793",
  "sys/dev/agp/agp.c:807",
  "sys/dev/agp/agp.c:809"
 ],
 "poc_changes": "agp_shim.c test2399 drives the verbatim cdev open/close entry points with fabricated dev_ops args",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64",
 "runtime_sec": 400,
 "guest_dirty": 0,
 "runner": "df-bsd-reviewer",
 "build_cmd": "make -j5 nativekernel KERNCONF=ACHARNESS (see build.sh; stock-kernel findings need no build)",
 "run_cmd": "see run.sh",
 "code_hash": "cb21865e4336f2800be8cae82626093876efb27f589b4927a8ab27d7e83ed8bf",
 "notes": "",
 "recommended_fix": "see fix.diff",
 "fix_status": "compile_validated"
}