{
 "finding_id": "DF-2807",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "denial_of_service",
 "confidence": "certain",
 "verdict": "Mechanically reproduced as root on the stock guest with a single /dev/udev reader (O_NONBLOCK): after the mandatory initiation read arms the marker (kern_udev.c:826-829), two distinctive events were generated (vnconfig attach family, h41 make_dev). A 1-byte read returned -1/ENOMEM AND consumed the first (564-byte) event: the follow-up full read delivered only the 824-byte second event - the first event was silently destroyed without delivery (kern_udev.c:846-860 advances the marker and reaps even on the short-buffer error). On the fix kernel the 1-byte read returns -1/EMSGSIZE (errno 40) and the first full read delivers the SAME 564-byte event first (verified against a no-short-read control sequence). Fix iteration: v1 (skip marker advance only) panicked the guest with prop_object_release ocnt!=0 because udev_event_externalize consumes the event dict reference (kern_udev.c:571) - v3 makes externalize non-consuming and moves the reference drop to the delivery point; validated stable across the full A/B suite.",
 "exploit_chain": "",
 "evidence": "run.log baseline: short read errno=12 + 564-byte event never delivered; fix kernel: errno=40 + 564-byte event delivered first (control: ab0 sequence shows 564B event is the queue head)",
 "kernel_refs": [
  "sys/kern/kern_udev.c:846",
  "sys/kern/kern_udev.c:857",
  "sys/kern/kern_udev.c:571"
 ],
 "poc_changes": "reader must be initiated first (first read arms the marker; udev_initiated_count gates event queueing); O_NONBLOCK to avoid blocking drain reads; exact-name XML extraction",
 "attempts": 4,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 400,
 "guest_dirty": 0,
 "build_cmd": "cc -Wall -O2 -o udev_short udev_short.c",
 "run_cmd": "./udev_short (as root, timeout 45)",
 "code_hash": "c097c4ee9ec0da31e707726b4c757549e75036fe50b955a8c68dd50cd757e5d7",
 "notes": "Root-gated (devfs perms 0600); silent hotplug event loss for small-buffer consumers",
 "recommended_fix": "Short buffer: kfree xml, EMSGSIZE, no marker advance; move the event dict release to the delivery point",
 "fix_status": "fixed",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)",
 "fix_verdict": "A/B: baseline ENOMEM + silent event loss; fix kernel EMSGSIZE + event preserved. v1 fix double-release (prop_object_release panic) caught by fix validation and reworked to a non-consuming externalize."
}