{
  "finding_id": "DF-2660",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Not verified on the guest (status untested): the planned hammer (tight rm/recreate loop of the same filename against a diverged merged rw cluster, racing the 5s sync passes' insert path) could not be run to completion because every multi-session cluster run on this guest was killed by the pre-existing DF-2620-family teardown UAF (DF-2657 panic_serial.log). The defect is structural and line-certain: the sync scan runs with the inode unlocked (synchro.c:458) and the parent shared, hammer2_sync_insert() relocks exclusively and re-looks-up the key as a TOCTOU check, then KKASSERT(chain == NULL) (synchro.c:758) panics INVARIANTS kernels when a concurrent VOP create/rename xop (writing all columns incl. idx) inserted the same key in the window; production kernels fall into duplicate-key chain_create against the RB tree (hammer2_chain_cmp counts overlap as match, chain.c:113-117). Reachable on stock for >=3-master clusters and on DF-2657-fixed kernels for 2-master clusters.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-2660/README.md (race window path:line, panic assertion, fix)",
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_synchro.c:458",
    "sys/vfs/hammer2/hammer2_synchro.c:555",
    "sys/vfs/hammer2/hammer2_synchro.c:741",
    "sys/vfs/hammer2/hammer2_synchro.c:753",
    "sys/vfs/hammer2/hammer2_synchro.c:758",
    "sys/vfs/hammer2/hammer2_chain.c:113"
  ],
  "poc_changes": "n/a (no seed PoC existed; audit-time discovery)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Filed from pass-2 audit of hammer2_synchro.c. Medium severity (local panic/DoS on rw multi-master clusters; possible chain-tree confusion on non-INVARIANTS). Follow-up: run the hammer on a UAF-free kernel (blocked by DF-2620 family on this guest).",
  "recommended_fix": "Replace KKASSERT(chain == NULL) in hammer2_sync_insert() with an EAGAIN return when the re-lookup finds a raced chain (the caller already retries on EAGAIN)."
}