{
 "finding_id": "DF-2409",
 "verdict": "reproduced",
 "impact": "panic",
 "reproduce": {
  "build": "see build.sh (dfhw.ko + tpm.ko)",
  "run": "/root/t20 (open+write+close /dev/tpm0 then sysctl t20_snapshot + t20_release_canary; sleep 2)",
  "expected": "UAF write through the stale 500ms discard_buffer_callout: production tpm20_init created a real /dev/tpm0, a userland open+write+close armed the callout via production tpm20_write, production tpm20_rel"
 },
 "kernel_refs": [
  "sys/dev/crypto/tpm/tpm20.c:144",
  "sys/dev/crypto/tpm/tpm20.c:199",
  "sys/dev/crypto/tpm/tpm20.c:213"
 ],
 "artifacts": [
  "README.md",
  "VERDICT.md",
  "build.sh",
  "dfhw.c",
  "env.txt",
  "fix.diff",
  "manifest.json",
  "panic.txt",
  "run.sh",
  "t20.c",
  "verdict.json"
 ]
}