{
 "finding_id": "DF-2787",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Confirmed both by reading and mechanically: mtx_notlocked_ex (sys/sys/mutex2.h:436-442) documents Return TRUE (non-zero) if the mutex is not locked exclusively but returns (mtx_lock & MTX_EXCLUSIVE) != 0 - TRUE when it IS exclusively locked. Harness T13 on the stock guest: while exclusively locked the function returned 1 (doc says 0); after unlock it returned 0 (doc says 1) - the exact inversion. Zero in-tree callers (rg: only the definition), so latent API trap only. On the fix kernel T13 returns 0 then 1 per the documented contract.",
 "exploit_chain": "",
 "evidence": "harness.log T13 lines; fix.diff (== 0 inversion)",
 "kernel_refs": [
  "sys/sys/mutex2.h:436",
  "sys/sys/mutex2.h:439"
 ],
 "poc_changes": "none",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 20,
 "guest_dirty": 0,
 "build_cmd": "cd /root/h41 && make",
 "run_cmd": "kldload ./h41.ko; sysctl -w debug.h41.cmd=13",
 "code_hash": "85d6e241caa2a7fb1fb44b80c7736a4e83c36d29314b0c96ce91769bc9bdf839",
 "notes": "No in-tree caller; one-line inversion fix",
 "recommended_fix": "Return ((mtx->mtx_lock & MTX_EXCLUSIVE) == 0)",
 "fix_status": "fixed",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)",
 "fix_verdict": "A/B: baseline T13 while-ex-locked=1/after-unlock=0 (inverted); fix kernel 0/1 (doc-correct)."
}