# DF-2441 - Verification Verdict

**Status:** reproduced
**Impact:** panic
**Confidence:** certain

## Mechanism
dmstrategy (line 365-366) and dmdump (line 474-475) dereference dmv = dev->si_drv1 with no NULL check - unlike dmsize and disk_ioctl_switch which both guard ((dmv = dev->si_drv1) == NULL). If a strategy/dump arrives in the window where the dm device is being destroyed (si_drv1 cleared before the dev is removed), the kernel NULL-derefs at dm_table_size(&dmv->table_head).

## Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Latent race-window panic (not deterministically triggerable without driving the destroy path under I/O; sibling rigs for other dm findings hit different, deeper races). Code-certain asymmetry versus the guarded dmsize at line 330 and line 542.

## Threat / reachability
Race-window kernel panic on dm device destroy under I/O (root-configured devices).

## Privilege escalation assessment
n/a (hardening)

## Fix
Mirror the dmsize NULL guards in dmstrategy (fail the bio with ENXIO + biodone) and dmdump (return ENXIO).

## Kernel references
- `sys/dev/disk/dm/device-mapper.c:365`
- `sys/dev/disk/dm/device-mapper.c:394`
- `sys/dev/disk/dm/device-mapper.c:474`
- `sys/dev/disk/dm/device-mapper.c:330`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.