# DF-2457 VERDICT

**Status:** reproduced
**Impact:** panic
**Confidence:** certain

fd_detach leaves fd->tohandle armed: with tohandle armed exactly as fdstate does (fd.c:1980), production fd_detach returned with the callout STILL PENDING (it stops only toffhandle and motor at fd.c:1090-1091); after the softc free-and-canary the callout fired into the freed object and the INVARIANTS callout verifier panicked naming the canary: _callout ... toc 0x4141414141414141 (expected <callout addr>) - the embedded callout struct at softc+0x68 read from freed-and-reused memory.

## Kernel references
- `sys/dev/disk/fd/fd.c:1090`
- `sys/dev/disk/fd/fd.c:1980`
- `sys/dev/disk/fd/fd.c:1970`

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

## Notes


## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.