{
 "finding_id": "DF-2765",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "journal_nrename journals both path leaves after the underlying op (vfs_jops.c:1322-1323), but cache_rename relinked fnch->ncp to the target name and destroyed tnch->ncp, so PATH1==PATH2==target and the source path never enters the stream (reproduced: 'jt/a/src.txt' count 0, target count 2). Journal replay/undo of renames is therefore impossible - silent replica divergence. Fix (capture PATH1 pre-op) validated on the patched kernel: source count 1, target count 1.",
 "exploit_chain": "",
 "evidence": [
  "decode_out.txt (PATH1@0x60='jt/b/dst.txt', PATH2|LAST@0x78='jt/b/dst.txt', source count 0)",
  "journal_stream.bin (192 B raw stream)",
  "run_fixed.log + journal_stream_fixed.bin (post-fix: source present)"
 ],
 "kernel_refs": [
  "sys/kern/vfs_jops.c:1322-1323",
  "sys/kern/vfs_cache.c:2118-2141",
  "sys/kern/vfs_default.c:1064"
 ],
 "poc_changes": "authored from scratch; reused the DF-2747-proven mountctl recipe",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 (baseline); fixed kernel #2 Mon Aug 31 23:12:27 UTC 2026",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "build_cmd": "(none)",
 "run_cmd": "sh df2765_run.sh (root)",
 "code_hash": "f8555891c77525a341175b6399d2ac1692f76461cd9f0fd4b29ca11b834e4d49",
 "notes": "impact=none in the security sense: data-integrity bug of the (root-installed) journaling feature, not memory corruption",
 "recommended_fix": "snapshot the source ncp path before vop_journal_operate_ap in journal_nrename (fix.diff hunk 4)",
 "fix_status": "fixed",
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #2: Mon Aug 31 23:12:27 UTC 2026",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_verdict": "post-fix stream contains PATH1='jt/a/src.txt' (pre-op) and PATH2='jt/b/dst.txt'; baseline had source absent / target duplicated",
 "fix_evidence": [
  "run_fixed.log",
  "journal_stream_fixed.bin"
 ]
}