# DF-2528 verdict -- Unlocked vn_softc state races vnclear (NULL deref / UAF)

status: not_reproduced   reproduced: 0   impact: none
confidence: likely   attempts: 1   runtime_sec: 400

A root-driven hammer (raw dd I/O on vn3 racing 8 vnconfig -u detach rounds) produced no panic - the window is narrow and the opencount gate serializes the common case. The source trace stands: struct vn_softc carries no lock; vnstrategy/vnget peek VNF_INITED/sc_vp unlocked while vnclear (VNIOCDETACH, RESTRICTEDROOT) closes the vnode, deallocates the object and NULLs the pointers (:744-756); disk_getopencount is an unlocked read. Privileged-cooperator local DoS as filed. Fix (state token serializing the strategy snapshot against vnclear) compile-validated in the vn module build; the full vnode-lifetime fix additionally needs a held reference across I/O (noted in the diff).

## Evidence (decisive lines)
HAMMER_DONE - no panic, guest alive, vn3 detached cleanly (race not hit)
vn module with token fix: BUILD OK




## Exploit chain / privesc assessment
root+operator cooperation required; ceiling: panic/UAF on a racing detach.

## Fix + A/B
fix.diff adds sc_iotok and takes it across the strategy state snapshot and the vnclear teardown; compile-validated.


## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.