# DF-2433 VERDICT

**Status:** not_reproduced
**Impact:** none
**Confidence:** likely

Line-accurate code confirmation (the CCDF_INITED guard at ccd.c:1309-1310 runs before ccdlock and is never re-checked under the lock; ccdinit sets INITED at :591 under the lock; a second SET that passed the lockless check re-runs ccdinit, overwrites sc_cinfo/sc_itable and ccddevs[unit].ccd_cpp/ccd_vpp, leaking the first configuration and its component vnodes) - and the leak consequence was observed live earlier in the session (vn2s0a/vn3s0a stayed permanently busy after a configured SET whose CLR could not run). However a mechanical double-success race could not be produced: on this snapshot the auto-created ccd0s0 compat slice pins a reference on sc_dev so CCDIOCCLR returns EBUSY for every successfully configured ccd, blocking the SET/CLR cycling the race needs (rig-assisted ref release and fresh component pairs still hit component-busy via the devfs slice probe).

## Kernel references
- `sys/dev/disk/ccd/ccd.c:1310`
- `sys/dev/disk/ccd/ccd.c:591`
- `sys/dev/disk/ccd/ccd.c:1460`

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

## Notes
code defect certain; the race consequence (leaked vnodes/heap per double-SET) follows directly from the missing recheck

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.