{
 "finding_id": "DF-2646",
 "status": "inconclusive",
 "reproduced": 0,
 "impact": "none",
 "confidence": "speculative",
 "verdict": "Race-dependent NULL-deref/KKASSERT panic in hammer2_flush_core LOST CHILD3 (flush.c:681-690) when a detached chain (parent==NULL at flush entry) gains a parent during the flusher's unlock window (flush.c:661-665) via a concurrent frontend rename adoption. Code path proven; runtime reproduction requires winning a microsecond-scale lock interleaving with no deterministic unprivileged schedule, so Phase V is skipped per contract for speculative race findings. Mirror-image of the known parent->NULL findings (DF-0813/DF-2568) at a different site and transition direction.",
 "exploit_chain": "",
 "evidence": [
  "findings/poc/DF-2646/VERDICT.md (full code-path analysis with path:line citations)"
 ],
 "kernel_refs": [
  "sys/vfs/hammer2/hammer2_flush.c:681-690",
  "sys/vfs/hammer2/hammer2_flush.c:661-665",
  "sys/vfs/hammer2/hammer2_flush.c:504-506",
  "sys/vfs/hammer2/hammer2_chain.c:1132-1138"
 ],
 "poc_changes": "n/a (no runnable PoC; race not schedulably winnable)",
 "attempts": 0,
 "guest_uname": "n/a",
 "runtime_sec": 0,
 "guest_dirty": 0,
 "build_cmd": "n/a",
 "run_cmd": "n/a",
 "code_hash": "",
 "notes": "Trigger requires concurrent rename-adoption of the exact chain being flushed during a 3-op lock window; no biasing harness possible for the interleaving. KKASSERT is unconditional on DragonFly so stock kernels panic at :686; non-INVARIANTS kernels NULL-deref inside hammer2_chain_unlock(NULL).",
 "recommended_fix": "Guard the unlock: 'if (parent) hammer2_chain_unlock(parent);' in the LOST CHILD3 path (hammer2_flush.c:686-687)"
}