{
  "finding_id": "DF-2707",
  "title": "kern_dmsg duplicate transmitted DELETE: double RB_REMOVE + phantom rbtree refdrop -> state-tree corruption + premature free (UAF), peer-driven on production kernels",
  "verdict": "reproduced",
  "impact": "panic (memcorrupt class: write-capable UAF, code-exec ceiling)",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -O -I/usr/src/sys -o df2707_trigger df2707_trigger.c (guest); non-INVARIANTS kernel via sed of X86_64_GENERIC + make nativekernel/installkernel + reboot",
    "run": "sh /root/poc/df2707/run_df2707.sh attack 3 24   (controls: leak, wedge)",
    "expected": "baseline non-INVARIANTS: Fatal trap 12 in kdmsg_state_tree_RB_REMOVE_COLOR (guest dies mid-run); INVARIANTS stock: panic at kern_dmsg.c:1076 (DF-0018); fix kernel: all rounds complete, UMOUNT_RC=0"
  },
  "kernel_refs": ["sys/kern/kern_dmsg.c:1670-1707", "sys/kern/kern_dmsg.c:2056-2058", "sys/kern/kern_dmsg.c:1558-1573", "sys/kern/kern_dmsg.c:1075-1077", "sys/kern/kern_dmsg.c:1195-1211", "sys/sys/tree.h:585-660"],
  "artifacts": ["README.md", "VERDICT.md", "df2707_trigger.c", "run_df2707.sh", "build.sh", "run.sh", "build.log", "panic.txt", "panic.invariants_baseline.txt", "run.attack2_ssh.log", "run.attack2_trigger.out", "run.wedge_probe.txt", "run.fix.log", "run.fix.2.log", "fix.diff", "env.txt", "manifest.json", "verdict.json"]
}