{
 "finding_id": "DF-2457",
 "verdict": "reproduced",
 "impact": "panic",
 "reproduce": {
  "build": "see build.sh (dfhw.ko verbatim fd)",
  "run": "sysctl kern.dfhwgo=fd_detach_uaf",
  "expected": "fd_detach leaves fd->tohandle armed: with tohandle armed exactly as fdstate does (fd.c:1980), production fd_detach returned with the callout STILL PENDING (it stops only toffhandle and motor at fd.c:1"
 },
 "kernel_refs": [
  "sys/dev/disk/fd/fd.c:1090",
  "sys/dev/disk/fd/fd.c:1980",
  "sys/dev/disk/fd/fd.c:1970"
 ],
 "artifacts": [
  "README.md",
  "VERDICT.md",
  "build.sh",
  "env.txt",
  "fix.diff",
  "manifest.json",
  "panic.txt",
  "run.sh",
  "verdict.json"
 ]
}