# DF-2726 - Verification Verdict

**Status:** reproduced
**Impact:** corruption
**Confidence:** certain

## Mechanism
cluster_write reads bp->b_bio2.bio_offset AFTER releasing the buffer: the trailing cc->v_lasta = bp->b_bio2.bio_offset + blksize (1408-1409) runs after every fall-through branch has already bdwrite(bp)/bawrite(bp), and the same pattern appears after the VOP_REALLOCBLKS bdwrite loop (1346-1348) and after the VOP_BMAP bdwrite (1364-1366). Buffers are type-stable (objcache), so the read usually returns stale or recycled-buffer data - silently corrupting the v_lasta physical-contiguity heuristic.

## Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain post-release read: no deterministic runtime trigger (needs the buffer recycled in the window); consequences are wrong clustering decisions (performance/fragmentation), not a direct disclosure. fix.diff snapshots the physical offset into a local before each release and uses it for every post-release consumer - compile-validated.

## Threat / reachability
Type-stable use-after-free READS in the write-clustering heuristic (data-plane correctness, not disclosure).

## Privilege escalation assessment
n/a (hardening)

## Fix
Snapshot bio_offset into a local (phys_offset) before each bdwrite/bawrite and use the local afterwards.

## Kernel references
- `sys/kern/vfs_cluster.c:1408`
- `sys/kern/vfs_cluster.c:1346`
- `sys/kern/vfs_cluster.c:1364`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.