{
  "finding_id": "DF-2688",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "Lock-discipline defect is certain by inspection: the swap-full OOM kill block (sys/vm/vm_pageout.c:1824-1837) dereferences bigproc fields and walks FIRST_LWP_IN_PROC()'s rb tree without p_token and without re-validating p_stat, racing concurrent lwp teardown (kern_exit.c:773 lwp_rb_tree_RB_REMOVE) across a window widened by an intervening kprintf. However, teardown analysis shows the callback's PHOLD keeps the proc, master lwp, and lwp_thread allocated through the window, so no demonstrable UAF of freed memory exists; worst realistic outcome is a panic via a torn rb-tree walk / empty-tree NULL deref in dfly_resetpriority, under total swap exhaustion. Not run on the guest: Low severity timing race outside the mandatory verification set; executing it would intentionally wedge the single-tenant guest at swap_pager_full.",
  "exploit_chain": "",
  "evidence": [
    "sys/vm/vm_pageout.c:1824-1837 (kill block, no p_token, no p_stat recheck)",
    "sys/vm/vm_pageout.c:1841-1891 (callback takes p_token + PHOLD, filters p_stat)",
    "sys/kern/kern_exit.c:766-780 (lwp unlinked from p_lwp_tree before async reap; master lwp left on tree)",
    "sys/kern/usched_dfly.c:1091-1158 (resetpriority reads lp->lwp_qcpu/lwp_proc, writes lp->lwp_thread->td_upri)",
    "findings/poc/DF-2688/VERDICT.md (full teardown/impact analysis)",
    "findings/poc/DF-2688/fix.diff (token + revalidation + NULL-check fix)"
  ],
  "kernel_refs": [
    "sys/vm/vm_pageout.c:1824",
    "sys/vm/vm_pageout.c:1831",
    "sys/vm/vm_pageout.c:1862",
    "sys/kern/kern_exit.c:773",
    "sys/kern/usched_dfly.c:1091"
  ],
  "poc_changes": "Authored seed trigger df2688_trigger.c (unverified): swap-exhaustion hoggers plus a repeatedly-exiting biggest process to race the once-per-second kill window.",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o df2688_trigger df2688_trigger.c (NOT executed)",
  "run_cmd": "./df2688_trigger as unprivileged user (NOT executed)",
  "code_hash": "",
  "notes": "Guest left up and clean. PHOLD-based lifetime analysis in VERDICT.md explains why impact is capped at panic and why the defect was not escalated to Medium. Fix is one re-validation block; token is source-reentrant so holding it across killproc is safe.",
  "recommended_fix": "Retake p_token, revalidate p_stat in {SACTIVE,SSTOP,SCORE}, and NULL-check FIRST_LWP_IN_PROC before resetpriority in the OOM kill block."
}