{
 "finding_id": "DF-2761",
 "status": "reproduced",
 "reproduced": 1,
 "impact": null,
 "confidence": "certain",
 "verdict": "REPRODUCED as root on the stock guest: two writer threads setlogin(A*32)/setlogin(B*32) plus a reader thread; 105318 of 7103819 getlogin observations returned MIXED A/B names (samples: AAAAAAAAAAAAAAAAAAAAAAAABBBBBBBB). The 32-byte s_login store is torn exactly as predicted by the shared-token analysis.",
 "exploit_chain": "no escalation path: setlogin is SYSCAP-gated; integrity-only (torn login names)",
 "evidence": "run.log: 105318 of 7103819 getlogin reads returned MIXED A/B names (samples logged), proving the shared-token memcpy interleaves",
 "kernel_refs": [
  "sys/kern/kern_prot.c:1291",
  "sys/kern/kern_prot.c:1292"
 ],
 "poc_changes": "none; 3-thread rig (2 writers + reader) as seeded",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 15,
 "guest_dirty": 0,
 "build_cmd": "cc -o setlogin_race setlogin_race.c -lpthread",
 "run_cmd": "as root: ./setlogin_race",
 "code_hash": "a494402f8634cd317ab8ca775a2be240e90915a4de22fe58ebe353ac4dac4681",
 "notes": "",
 "recommended_fix": "Take p_token EXCLUSIVE (lwkt_gettoken) for the mutation.",
 "fix_status": "not_testable",
 "fix_kernel_uname": null,
 "fix_baseline_reproduced": null,
 "fix_patched_reproduced": null,
 "fix_verdict": "fix.diff compile-validated in the batch combined kernel build (all 37 diffs of this batch applied to in-guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC, see batch build log referenced in VERDICT.md); no behavior A/B performed for this Info-tier item; behavior A/B intentionally skipped for Info tier",
 "fix_evidence": "batch combined kernel build log (see findings/poc/_batch41 note in VERDICT.md)"
}