{
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "likely",
 "verdict": "Line-accurate code confirmation (the CCDF_INITED guard at ccd.c:1309-1310 runs before ccdlock and is never re-checked under the lock; ccdinit sets INITED at :591 under the lock; a second SET that passed the lockless check re-runs ccdinit, overwrites sc_cinfo/sc_itable and ccddevs[unit].ccd_cpp/ccd_vpp, leaking the first configuration and its component vnodes) - and the leak consequence was observed live earlier in the session (vn2s0a/vn3s0a stayed permanently busy after a configured SET whose CLR could not run). However a mechanical double-success race could not be produced: on this snapshot the auto-created ccd0s0 compat slice pins a reference on sc_dev so CCDIOCCLR returns EBUSY for every successfully configured ccd, blocking the SET/CLR cycling the race needs (rig-assisted ref release and fresh component pairs still hit component-busy via the devfs slice probe).",
 "exploit_chain": "",
 "evidence": "VERDICT.md trace; the incidental permanent component pinning observed during DF-2434 work",
 "kernel_refs": [
  "sys/dev/disk/ccd/ccd.c:1310",
  "sys/dev/disk/ccd/ccd.c:591",
  "sys/dev/disk/ccd/ccd.c:1460"
 ],
 "poc_changes": "kernel-thread racer + ref-release plumbing in dfmisc.ko (blocked by environment refcounting)",
 "attempts": 5,
 "runtime_sec": 2400,
 "guest_dirty": 0,
 "build_cmd": "see build.sh (dfmisc.ko)",
 "run_cmd": "/root/miscctl race N",
 "notes": "code defect certain; the race consequence (leaked vnodes/heap per double-SET) follows directly from the missing recheck",
 "recommended_fix": "re-check (cs->sc_flags & CCDF_INITED) after taking ccdlock in CCDIOCSET (and CCDIOCCLR) and return EBUSY",
 "finding_id": "DF-2433",
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runner": "df-bsd-reviewer",
 "code_hash": "c3e6055258a4e7ac392e208f28967a4942c9379a32298d7d7e255178ea9d82ec"
}