{
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "UAF write through the stale 500ms discard_buffer_callout: production tpm20_init created a real /dev/tpm0, a userland open+write+close armed the callout via production tpm20_write, production tpm20_release freed/uninited without draining it, the sc was freed and immediately resurrected at the same address with sc->buf = 0x4141414141414141, and the callout fired into the freed object: Fatal trap 9 general protection fault at tpm20_discard_buffer+0x3d (movq $0,(%rcx)) - the memset(sc->buf,...) store through the canary pointer.",
 "exploit_chain": "write+close+/dev/tpm0 detach within 500ms -> callout fires on freed softc -> memset through stale sc->buf = attacker-influenced write if the chunk is reallocated before firing",
 "evidence": "panic.txt (trap 9 at the memset instruction in tpm20_discard_buffer); t20.c choreography source",
 "kernel_refs": [
  "sys/dev/crypto/tpm/tpm20.c:144",
  "sys/dev/crypto/tpm/tpm20.c:199",
  "sys/dev/crypto/tpm/tpm20.c:213"
 ],
 "poc_changes": "rig transmit stub returns 0; sc kmalloc/freed/resurrected exactly as the tpm_tis detach path would; everything else production (tpm20_init/write/release from stock tpm.ko)",
 "attempts": 2,
 "runtime_sec": 300,
 "guest_dirty": 0,
 "build_cmd": "see build.sh (dfhw.ko + tpm.ko)",
 "run_cmd": "/root/t20 (open+write+close /dev/tpm0 then sysctl t20_snapshot + t20_release_canary; sleep 2)",
 "notes": "trigger window: release/detach within 500ms of the write; root-only device (0600)",
 "recommended_fix": "callout_drain(&sc->discard_buffer_callout) (or callout_stop_sync) in tpm20_release before freeing sc->buf",
 "finding_id": "DF-2409",
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runner": "df-bsd-reviewer",
 "code_hash": "e99efca199b268bba7d8a5c858060ee1d47cfdb1c219493d2770cf082d10a928"
}