{
  "finding_id": "DF-2659",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "Not verified on the guest (status untested): reaching the crash requires a synced inode whose local cluster column chain is NULL at sync time, and within hammer2_synchro.c's own logic that state is prevented (iroot elements are mount-discovered; deferred inodes receive their idx element at defer time, synchro.c:601-605). The code defect is certain from line-accurate reading: hammer2_inode_chain_and_parent() dereferences chain->parent at inode.c:453/461 before any NULL return is possible (its else-branch only drops the spinlock), and both synchro.c call sites evaluate chain->bref.modify_tid BEFORE their own if (chain) guards (synchro.c:421 vs 422, and 687-697 with KKASSERT(parent != NULL) at 692) - i.e. the NULL path the author wrote defenses for would panic before any defense runs. Real-world triggers plausibly exist via error-path element NULLing (hammer2_inode_repoint, inode.c:1430-1438) or element removal shifting idx mid-run, but demonstrating one needs a live diverged/failed-column cluster and was blocked on this guest by the DF-2620-family teardown UAF (DF-2657 follow-up).",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-2659/README.md (root cause with path:line, trigger analysis, fix)",
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_synchro.c:417",
    "sys/vfs/hammer2/hammer2_synchro.c:421",
    "sys/vfs/hammer2/hammer2_synchro.c:422",
    "sys/vfs/hammer2/hammer2_synchro.c:687",
    "sys/vfs/hammer2/hammer2_synchro.c:692",
    "sys/vfs/hammer2/hammer2_inode.c:436",
    "sys/vfs/hammer2/hammer2_inode.c:453",
    "sys/vfs/hammer2/hammer2_inode.c:461",
    "sys/vfs/hammer2/hammer2_inode.c:1430"
  ],
  "poc_changes": "n/a (no seed PoC existed; audit-time discovery)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Filed from pass-2 audit of hammer2_synchro.c. Low severity / speculative reachability / certain code defect (dead defensive path). Fixed implicitly by any fix that makes inode_chain_and_parent honor its NULL contract.",
  "recommended_fix": "Make hammer2_inode_chain_and_parent() return NULL with *parentp=NULL for a NULL element, and move the want_update evaluation (synchro.c:421) inside the existing if (chain) guard."
}