{
  "finding": "DF-2668",
  "title": "fhstatfs(2)/fhstatvfs(2) mount hold-count underflow via nullfs pass-through VFS_FHTOVP — KKASSERT panic on INVARIANTS, live struct-mount UAF (kfree) on release kernels",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "cc -O -o /tmp/df2668 /tmp/fhstatfs_hold.c",
    "run": "mkdir -p /tmp/nmtest; echo anchor > /tmp/anchor_file; mount -t null /tmp /tmp/nmtest; /tmp/df2668 /tmp/nmtest/anchor_file  (as root)",
    "expected": "panic: assertion \"mp->mnt_refs == 0\" failed in mount_drop, backtrace mount_drop() <- sys_fhstatfs(); guest freezes in DDB"
  },
  "kernel_refs": [
    "sys/kern/vfs_syscalls.c:5074",
    "sys/kern/vfs_syscalls.c:5096",
    "sys/kern/vfs_syscalls.c:5135",
    "sys/kern/vfs_syscalls.c:5149",
    "sys/vfs/nullfs/null_vfsops.c:389",
    "sys/kern/vfs_mount.c:393",
    "sys/kern/vfs_mount.c:414"
  ],
  "artifacts": [
    "fhstatfs_hold.c", "build.sh", "setup_and_run.sh", "run.log", "panic.txt",
    "env.txt", "fix.diff", "run.patched.log", "fix_validation.log",
    "VERDICT.md", "verdict.json", "manifest.json"
  ]
}