{
  "finding_id": "DF-2639",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "hammer2_inode_create_pfs clears *errorp at entry and returns NULL through its done2 paths (scanlhc I/O error, lhc-window ENOSPC) without ever writing the real error, so hammer2_ioctl_pfs_snapshot reports success without creating the PFS/snapshot. Code-inspection finding; root-only silent failure; guest verification intentionally skipped per audit contract (Low).",
  "exploit_chain": "",
  "evidence": "README.md quotes both goto-done2 paths and the caller's nip==NULL/error==0 handling",
  "kernel_refs": ["sys/vfs/hammer2/hammer2_inode.c:1006", "sys/vfs/hammer2/hammer2_inode.c:1042-1051", "sys/vfs/hammer2/hammer2_inode.c:1108-1111", "sys/vfs/hammer2/hammer2_ioctl.c:878"],
  "poc_changes": "",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Would surface as HAMMER2IOC_PFS_SNAPSHOT returning 0 with no snapshot created.",
  "recommended_fix": "Assign *errorp on both done2 error paths in hammer2_inode_create_pfs."
}