# DF-2528 -- Unlocked vn_softc state races vnclear (NULL deref / UAF)

Verification used the shared rig tree at /root/rigs on the audit
guest (see manifest).  The rig for this finding: None  (rig.c = harness,
gen.sh = verbatim extractor, dfv_*_extract.h = generated production text).
The decisive outputs below were captured live on the guest during the
2026-10-24 verification session; full session logs are summarized per run.


## Build
    sh build.sh            # extracts verbatim driver text + builds the KLD

## Run (guest, root)
    kldload ./dfv_rig.ko
(for i in 1..8; do dd if=/dev/vn3 of=/dev/null bs=64k count=4; done) racing (vnconfig -u vn3 x8)

## Expected
no crash in the hammer; vn module builds with the token fix.

## Fix validation
fix.diff adds sc_iotok and takes it across the strategy state snapshot and the vnclear teardown; compile-validated.

Verdict: not_reproduced / impact=none (see verdict.json, VERDICT.md)