{
  "finding_id": "DF-2740",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Static verification only. kern_linker.c mutates/reads linker_file.refs, userrefs, the linker_files list and found_modules outside any consistent locking protocol: sys_kldload increments lf->userrefs and reads lf->id AFTER releasing kld_lock (kern_linker.c:814-821), linker_load_file's already-loaded refs++ (:320-325) and linker_load_dependencies' lfdep->refs++ (:1636) take no llf_lock, linker_reference_module does a non-atomic refs++ under llf_lock SHARED (:1128), linker_load_module walks found_modules unlocked (:1529), sys_kldnext (:909-923) and linker_file_lookup_symbol (:644-658) walk linker_files without llf_lock, and the KPI entry points linker_reference_module/linker_release_module have their kld_lock acquisition commented out (:1134, :1162) while in-tree callers (subr_firmware deferred thread, dm_target, mount fstype autoload, netgraph autoload) invoke them without kld_lock. These are genuine data races (UAF-write window in sys_kldload; torn list traversal from unprivileged kldnext vs privileged async loaders). No guest race was attempted: pure-syscall races are fully serialized by kld_lock, and every kld_lock-skipping mutator on this guest requires privileged setup, so no reliable unprivileged trigger exists. Low severity, hardening-class.",
  "exploit_chain": "",
  "evidence": [
    "README.md (site-by-site lock-context table)",
    "fix.diff (advisory hardening: userrefs++/id inside kld_lock; refs++ under llf_lock)"
  ],
  "kernel_refs": [
    "sys/kern/kern_linker.c:814",
    "sys/kern/kern_linker.c:820",
    "sys/kern/kern_linker.c:324",
    "sys/kern/kern_linker.c:518",
    "sys/kern/kern_linker.c:1128",
    "sys/kern/kern_linker.c:1529",
    "sys/kern/kern_linker.c:910",
    "sys/kern/kern_linker.c:644",
    "sys/kern/kern_linker.c:1134",
    "sys/kern/kern_linker.c:1162",
    "sys/kern/subr_firmware.c:274",
    "sys/dev/disk/dm/dm_target.c:75",
    "sys/kern/vfs_syscalls.c:324"
  ],
  "poc_changes": "n/a — analysis-only verification",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Race requires a kld_lock-skipping mutator (all privileged on this guest). Unprivileged kldnext(2) readers are exposed only when an administrator runs firmware/dm/mount/ng autoload concurrently. Recommended full fix in README.md.",
  "recommended_fix": "Serialize all refs/userrefs mutations and linker_files/found_modules walks with llf_lock; move sys_kldload's userrefs++/id read inside kld_lock; restore kld_lock (or llf_lock-only safety) for the reference/release KPIs.",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Advisory fix.diff (two highest-value hardenings) authored and code-reviewed; not built/tested because no reliable race harness exists on this guest without privileged async loaders.",
  "fix_evidence": []
}