# DF-2477 -- md MOD_UNLOAD refcnt TOCTOU frees md_s under a racing mdopen

Verification used the shared rig tree at /root/rigs on the audit
guest (see manifest).  The rig for this finding: dfv_md  (rig.c = harness,
gen.sh = verbatim extractor, dfv_*_extract.h = generated production text).
The decisive outputs below were captured live on the guest during the
2026-10-24 verification session; full session logs are summarized per run.


## Build
    sh build.sh            # extracts verbatim driver text + builds the KLD

## Run (guest, root)
    kldload ./dfv_rig.ko
kldload dfv_md.ko; sysctl kern.dfv_md_run=1; sysctl -n kern.dfv_md_status

## Expected
run.log: racing mdopen rc=0 refcnt=1 (open SUCCEEDED against an sc that was then freed); si_drv1 never NULLed; reclaim-read 0xc7c7c7c7; fixed: EBUSY, no frees in log, reclaim-read intact.

## Fix validation
fix.diff drains the cdev (destroy_dev) and re-checks refcnt before any free; A/B on the same rig shows EBUSY and no free.

Verdict: reproduced / impact=corruption (see verdict.json, VERDICT.md)