{
  "finding_id": "DF-2755",
  "title": "TIOCSCTTY s_ttyvp unsynchronized RMW race -> double vrele -> vnode refcount underflow -> UAF",
  "verdict": "reproduced",
  "impact": "memcorrupt (kernel UAF; panic demonstrated unprivileged)",
  "reproduce": {
    "build": "cc -O2 -pthread -o df2755 df2755.c",
    "run": "./df2755 3 60",
    "expected": "stock kernel: panic 'vref: bad refcnt 00000000 1' with devfs_fo_ioctl+0x13f in the trace within seconds..tens of seconds; fixed kernel: clean exit"
  },
  "kernel_refs": [
    "sys/kern/vfs_vnops.c:1030-1055",
    "sys/vfs/devfs/devfs_vnops.c:1595-1611",
    "sys/vfs/devfs/devfs_vnops.c:1153-1156",
    "sys/kern/tty.c:328-382",
    "sys/kern/kern_descrip.c:2031-2034",
    "sys/kern/tty.c:1181-1204",
    "sys/kern/vfs_lock.c:267-270"
  ],
  "artifacts": [
    "df2755.c", "build.sh", "run.sh",
    "run.log", "run.2.log", "run.3.log",
    "build.log", "panic.txt", "panic1.txt", "panic2.txt",
    "env.txt", "fix.diff", "VERDICT.md", "README.md",
    "manifest.json", "verdict.json"
  ]
}