{
  "finding_id": "DF-2765",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "journal_nrename journals both path leaves after the underlying op (vfs_jops.c:1322-1323), but cache_rename relinked fnch->ncp to the target name and destroyed tnch->ncp, so PATH1==PATH2==target and the source path never enters the stream (reproduced: jt/a/src.txt count 0, target count 2). Journal replay/undo of renames is therefore impossible - silent replica divergence. Fix (capture PATH1 pre-op) validated on the patched kernel: source count 1, target count 1.",
  "exploit_chain": "",
  "evidence": [
    "decode_out.txt (PATH1@0x60='jt/b/dst.txt', PATH2|LAST@0x78='jt/b/dst.txt', source count 0)",
    "journal_stream.bin (192 B raw stream)",
    "run_fixed.log + journal_stream_fixed.bin (post-fix: source present)"
  ],
  "kernel_refs": [
    "sys/kern/vfs_jops.c:1322-1323",
    "sys/kern/vfs_cache.c:2118-2141",
    "sys/kern/vfs_default.c:1064"
  ],
  "poc_changes": "authored from scratch; reused the DF-2747-proven mountctl recipe",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 (baseline); fixed kernel #2 Mon Aug 31 23:12:27 UTC 2026",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "(none)",
  "run_cmd": "sh df2765_run.sh (root)",
  "code_hash": "f8555891c77525a341175b6399d2ac1692f76461cd9f0fd4b29ca11b834e4d49",
  "notes": "impact=none in the security sense: data-integrity bug of the (root-installed) journaling feature, not memory corruption",
  "recommended_fix": "snapshot the source ncp path before vop_journal_operate_ap in journal_nrename (fix.diff hunk 4)",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #2: Mon Aug 31 23:12:27 UTC 2026",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "post-fix stream contains PATH1=jt/a/src.txt (pre-op) and PATH2=jt/b/dst.txt; baseline had source absent / target duplicated",
  "fix_evidence": [
    "run_fixed.log",
    "journal_stream_fixed.bin"
  ]
}