{
 "finding_id": "DF-2766",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "journal_remove_all_journals() (vfs_jops.c:422-430, from dounmount vfs_syscalls.c:1037) destroys the journals but never calls journal_detach(), and mnt_jbitmap (1024 B, M_JOURNAL) has no other freeing path on the unmount route - vmstat -m shows exactly 5.00K leaked after 5 journaled mount/unmount cycles (journal-fifo returns to 0, proving the destroy path otherwise frees). Fix (detach on drain) validated: in-use stays 0 over the same 5 cycles.",
 "exploit_chain": "",
 "evidence": [
  "run.log (0 -> 5 / 5.00K vs journal-fifo 0)",
  "run_fixed.log (in-use stays 0 after fix)"
 ],
 "kernel_refs": [
  "sys/kern/vfs_jops.c:423-430",
  "sys/kern/vfs_jops.c:251",
  "sys/kern/vfs_syscalls.c:1037-1038"
 ],
 "poc_changes": "authored from scratch; vmstat -m malloc-type accounting as the oracle",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 (baseline); fixed kernel #2 Mon Aug 31 23:12:27 UTC 2026",
 "runtime_sec": 90,
 "guest_dirty": 0,
 "build_cmd": "(none)",
 "run_cmd": "sh df2766_run.sh (root)",
 "code_hash": "1485d50c5a4f02d4a3f28221ea1c8bde1e91aafaf257bc0c5a85227458df177c",
 "notes": "pure resource leak, no memory-safety impact; root-gated feature",
 "recommended_fix": "journal_remove_all_journals: call journal_detach() when mnt_jlist drains (fix.diff hunk 3)",
 "fix_status": "fixed",
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #2: Mon Aug 31 23:12:27 UTC 2026",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_verdict": "same 5-cycle run on patched kernel: journal in-use 0 (vs 5.00K baseline)",
 "fix_evidence": [
  "run_fixed.log"
 ]
}