{
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "fd_detach leaves fd->tohandle armed: with tohandle armed exactly as fdstate does (fd.c:1980), production fd_detach returned with the callout STILL PENDING (it stops only toffhandle and motor at fd.c:1090-1091); after the softc free-and-canary the callout fired into the freed object and the INVARIANTS callout verifier panicked naming the canary: _callout ... toc 0x4141414141414141 (expected <callout addr>) - the embedded callout struct at softc+0x68 read from freed-and-reused memory.",
 "exploit_chain": "detach (module/card removal) with I/O in flight -> armed watchdog callout survives fd_detach -> fires on freed softc (callout-after-free: jump-through-freed or field writes via stale fdc)",
 "evidence": "panic.txt (callout verifier message with the canary value)",
 "kernel_refs": [
  "sys/dev/disk/fd/fd.c:1090",
  "sys/dev/disk/fd/fd.c:1980",
  "sys/dev/disk/fd/fd.c:1970"
 ],
 "poc_changes": "verbatim fd.c in the rig; tohandle armed via the production callout_reset line; softc freed+canaried to emulate detach teardown",
 "attempts": 1,
 "runtime_sec": 200,
 "guest_dirty": 0,
 "build_cmd": "see build.sh (dfhw.ko verbatim fd)",
 "run_cmd": "sysctl kern.dfhwgo=fd_detach_uaf",
 "notes": "",
 "recommended_fix": "callout_stop(&fd->tohandle) (drain under load) in fd_detach beside the toffhandle/motor stops",
 "finding_id": "DF-2457",
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runner": "df-bsd-reviewer",
 "code_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
}