# DF-2807 — VERDICT

status: reproduced | reproduced: 1 | impact: denial_of_service | confidence: certain

Mechanically reproduced as root on the stock guest with a single /dev/udev reader (O_NONBLOCK): after the mandatory initiation read arms the marker (kern_udev.c:826-829), two distinctive events were generated (vnconfig attach family, h41 make_dev). A 1-byte read returned -1/ENOMEM AND consumed the first (564-byte) event: the follow-up full read delivered only the 824-byte second event - the first event was silently destroyed without delivery (kern_udev.c:846-860 advances the marker and reaps even on the short-buffer error). On the fix kernel the 1-byte read returns -1/EMSGSIZE (errno 40) and the first full read delivers the SAME 564-byte event first (verified against a no-short-read control sequence). Fix iteration: v1 (skip marker advance only) panicked the guest with prop_object_release ocnt!=0 because udev_event_externalize consumes the event dict reference (kern_udev.c:571) - v3 makes externalize non-consuming and moves the reference drop to the delivery point; validated stable across the full A/B suite.

## Fix-validation panic (v1)
Fix v1 (skip marker advance only) panicked the guest during A/B:
    panic: assertion "ocnt != 0" failed in prop_object_release
    udev_dev_read() ...
udev_event_externalize consumes the event dict reference
(kern_udev.c:571), so a retried read double-releases. v3 makes
externalize non-consuming and drops the reference at the delivery
point; validated stable.


## Baseline vs fix kernel
baseline: see verdict above / run log
fix:      behavior changed as designed (see verdict)