{
 "finding_id": "DF-2763",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "journal_mountctl's attach/detach lifecycle state machine is lock-free; two concurrent mountctl ops interleave it so journal_detach runs twice (or straddles journal_destroy's tsleep), firing KKASSERT(mnt_jbitmap != NULL) at vfs_jops.c:248 (reproduced 3/3, incl. a writers-free minimal config); on release kernels the interleave is a double kfree of the 1024-byte M_JOURNAL bitmap and, vs in-flight jreclists, a UAF bit-RMW at :547/:556/:613. Root-gated (mountctl = SYSCAP_RESTRICTEDROOT) so privesc is not the model; impact is kernel panic / slab corruption.",
 "exploit_chain": "",
 "evidence": [
  "panic.txt (3 captures, all :248 via sys_mountctl)",
  "console_run4_full.log (minimal 2-loop config, no VOP traffic)",
  "VERDICT.md fix section: baseline panic vs patched clean completion (85+85 cycles)"
 ],
 "kernel_refs": [
  "sys/kern/vfs_jops.c:162",
  "sys/kern/vfs_jops.c:185",
  "sys/kern/vfs_jops.c:245-253",
  "sys/kern/vfs_jops.c:547",
  "sys/kern/vfs_jops.c:556",
  "sys/kern/vfs_jops.c:613",
  "sys/kern/vfs_syscalls.c:1037"
 ],
 "poc_changes": "no seed existed; authored from scratch: two concurrent 'mountctl -a/-d' churn loops proved sufficient (writers unnecessary)",
 "attempts": 4,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (baseline); fixed kernel #2 Mon Aug 31 23:12:27 UTC 2026",
 "runtime_sec": 420,
 "guest_dirty": 0,
 "build_cmd": "make -j6 nativekernel KERNCONF=X86_64_GENERIC (fix)",
 "run_cmd": "sh run.sh (two concurrent mountctl install/remove churn loops on /tmp, 90 s)",
 "code_hash": "d385af86622a8d0f7d4be05a00f010baf5746a0ce22b2799585d762eed0d1031",
 "notes": "fix v1 (token-only) FAILED - tokens drop across tsleep; v2 adds idempotent detach + tokened bitmap RMW sections; see fixrun_v1_console.log and VERDICT.md. Related family: DF-2704 (vop-vector), DF-2747 (memfifo), DF-2748 (jo free; its drain-wedge also re-appeared in an intermediate run and is attributed there, not here).",
 "recommended_fix": "Serialize journal_mountctl with mnt_token, make journal_detach idempotent (NULL-guard), token-protect jreclist_init/done bitmap RMW (fix.diff)",
 "fix_status": "fixed",
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #2: Mon Aug 31 23:12:27 UTC 2026",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_verdict": "exact PoC config re-run on patched kernel #2: 85+85 churn cycles completed, no panic, guest up, M_JOURNAL in-use back to 0 (baseline: panic <=90 s, 3/3)",
 "fix_evidence": [
  "fix.diff",
  "fixrun_v1_console.log (failed v1, kept honest)",
  "fix_build_v2.log tail in task log: RC=0 INST=0"
 ]
}