{
  "finding_id": "DF-2782",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Race-gated NULL-pointer lockmgr panic in sys_mq_open proven on the stock kernel: 8 barrier-synchronized threads racing past the early unlocked limit check (sys_mqueue.c:452) from p_mqueue_cnt=511; when the counter reaches 512 in-flight, a thread takes the under-lock EMFILE branch at :577-580 and goto-exits while mq is still NULL (mq=mq_new happens only at :583), so the shared exit label (:595-596) executes lockmgr(&mq->mq_mtx, LK_RELEASE) on a NULL-derived address - kernel panicked: 'Fatal trap 12 ... Stopped at lockmgr_release+0x11', guest down. Independently corroborated: an identical signature was produced by a rejected fix iteration that introduced the same mq==NULL goto-exit shape at the same label (fixiter1_context.txt).",
  "exploit_chain": "seed p_mqueue_cnt to 511 -> barrier-release N threads into mq_open(O_CREAT) -> >=2 threads pass :452 at 511 -> first increments to 512 -> second hits :577 EMFILE -> goto exit with mq==NULL -> lockmgr on ~&((struct mqueue*)NULL)->mq_mtx (offset ~0x100) -> page fault -> panic. INVARIANTS-independent.",
  "evidence": ["panic.txt: Fatal trap 12, Stopped at lockmgr_release+0x11, current process 842, db> prompt", "run.log: ssh dropped mid-run + vm status down", "fixiter1_context.txt: identical signature via mq==NULL goto-exit", "fix_validation.log: 300 rounds survived on patched kernel"],
  "kernel_refs": ["sys/kern/sys_mqueue.c:452", "sys/kern/sys_mqueue.c:577-580", "sys/kern/sys_mqueue.c:583-584", "sys/kern/sys_mqueue.c:595-596"],
  "poc_changes": "none vs plan (unique per-iteration queue names to force the CREATE path, barrier+seed-511 choreography; round cleanup of fds and unlinks).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -pthread -o limit_race limit_race.c",
  "run_cmd": "./limit_race 300",
  "code_hash": "8f5180cdaff843de2f55e86efd79bb9cc0ce0b06600574fa5e753f224610ade4",
  "notes": "Found during Phase V: the DF-2781 fix iteration-1 panic reproduced the exact exit-path shape, prompting re-reading of the stock :577 branch. Panicked within the first 300-round run (survived-round prints were on the lost ssh log; serial panic + down state are the evidence).",
  "recommended_fix": "Guard the shared exit-path release with if (mq) (fix.diff) - mq is non-NULL on every other path reaching the label.",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Tue Sep  1 04:57:57 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Patched kernel (if (mq) guard): the same PoC ran 300 rounds x 8 threads without a panic ('survived 300 rounds'), guest up.",
  "fix_evidence": "fix_validation.log"
}