# DF-2761 - Verification Verdict

**Status:** reproduced
**Impact:** none (hardening)
**Confidence:** certain

## Mechanism
sys_setlogin mutates p_pgrp->pg_session->s_login (32-byte memcpy) while holding p_token SHARED (lwkt_gettoken_shared); shared tokens do not exclude each other, so two concurrent setlogin calls interleave mid-memcpy and concurrent getlogin observes torn names.

## Verdict
REPRODUCED as root on the stock guest: two writer threads setlogin(A*32)/setlogin(B*32) plus a reader thread; 105318 of 7103819 getlogin observations returned MIXED A/B names (samples: AAAAAAAAAAAAAAAAAAAAAAAABBBBBBBB). The 32-byte s_login store is torn exactly as predicted by the shared-token analysis.

## Threat / reachability
Root-gated integrity/race hardening (SYSCAP_NOPROC_SETLOGIN); torn login names visible to getlogin/last/audit consumers.

## Privilege escalation assessment
n/a (root-gated; integrity only)

## Fix
Take p_token EXCLUSIVE (lwkt_gettoken) for the mutation.

## Kernel references
- `sys/kern/kern_prot.c:1291`
- `sys/kern/kern_prot.c:1292`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.