# DF-2688 — OOM kill block operates on `bigproc` without `p_token` and without re-validating liveness

File: `sys/vm/vm_pageout.c:1812-1838` (`vm_pageout_scan_cache`), helper
`vm_pageout_scan_callback` at `sys/vm/vm_pageout.c:1841-1891`.

## Status

**UNTESTED (Low / speculative impact).** Not verified on the QEMU guest:
the finding is neither Critical/High nor in the memcorrupt/privesc bucket,
and triggering requires full swap exhaustion (`swap_pager_full`) plus a
microsecond-scale race against process exit at the pagedaemon's once-per-second
kill cadence — not a deterministic local program. Pack contains a seed
trigger for a future verify-mode run.

## Build / run (seed, UNVERIFIED)

```
cc -O2 -o df2688_trigger df2688_trigger.c
./df2688_trigger          # as an unprivileged user, on a system with swap configured
```

## Expected (if the race ever fires)

Kernel panic in `dfly_resetpriority` (NULL/garbage `lp`) called from
`vm_pageout_scan_cache`, e.g. NULL-deref at
`lp->lwp_qcpu` (`sys/kern/usched_dfly.c:1108`), or a torn
`FIRST_LWP_IN_PROC` rb-tree read racing `lwp_rb_tree_RB_REMOVE` in
`lwp_exit()` (`sys/kern/kern_exit.c:773`).

## Why it is only Low/speculative

Analysis (VERDICT.md) shows the callback's own `PHOLD` keeps the proc, its
master lwp, and the lwp's thread allocated through the race window
(non-master lwps are unlinked from `p_lwp_tree` *before* being freed, and
the master-exit lwp is never unlinked while the proc is held), so the
most likely outcome of the missing lock is a benign priority update on an
exiting lwp, with a panic only via a torn rb-tree walk. The lock-discipline
defect itself is certain by inspection; the exploitable consequence is not
demonstrated. See VERDICT.md for the full kill-chain analysis.