# DF-2700 - Verification Verdict

**Status:** reproduced
**Impact:** denial_of_service
**Confidence:** certain

## Mechanism
vfs_hang_addrlist takes NE_LOCK(nep) and then jumps to out WITHOUT NE_UNLOCK on the rn_inithead-failure path (ENOBUFS) and the vfs_create_addrlist_af-NULL path (ENOBUFS); the netexport lock stays held after return.

## Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain lock leak: the next export-related operation on that mount deadlocks (lock-order starvation / hang). Error-path only (out of radix nodes), so not runtime-driven in this batch.

## Threat / reachability
Error-path lock leak in NFS exporting: subsequent exports/ioctls on the mount hang the system.

## Privilege escalation assessment
n/a (hardening)

## Fix
NE_UNLOCK(nep) before both goto out sites.

## Kernel references
- `sys/kern/vfs_subr.c:2087`
- `sys/kern/vfs_subr.c:2094`
- `sys/kern/vfs_subr.c:2098`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.