{
 "finding_id": "DF-2820",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Code-certain confirmation (runtime demo deliberately not run: on the INVARIANTS guest the existing KKASSERT would just panic - the designed behavior - while the finding is about production builds): KMALLOC_CHECK_DOUBLE_FREE is defined by default (sys/_malloc.h:58) and bmap_set/bmap_clr maintain the bitmap unconditionally, but EVERY enforcement point in _kfree_obj is a KKASSERT (kern_kmalloc.c:968) which compiles to a no-op without INVARIANTS; the store at :969 is unconditional. Production consequences: common double free (destination slot empty) is fully silent - the same pointer enters the free ring twice and two subsequent kmalloc_obj callers receive the same object (cross-subsystem aliasing); occupied-slot case kprintfs (:964) but still overwrites, dropping a live free-object pointer. Amplifier for caller bugs only; no in-tree trigger. The shipped fix adds an unconditional bmap_test() refusal (rate-limited kprintf, ring left sane) compiled into the fix kernel.",
 "exploit_chain": "",
 "evidence": "sourcenote.txt: line-accurate map of the enforcement points; fix.diff adds unconditional bmap_test refusal",
 "kernel_refs": [
  "sys/kern/kern_kmalloc.c:963",
  "sys/kern/kern_kmalloc.c:968",
  "sys/sys/_malloc.h:58"
 ],
 "poc_changes": "none (deliberate; INVARIANTS guest would only show the designed panic)",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 20,
 "guest_dirty": 0,
 "build_cmd": "(source confirmation only)",
 "run_cmd": "(source confirmation only)",
 "code_hash": "ad8e2bd59267be570877efbc33f00c54a35b75bfa8055686f5c1bdab7acc9c59",
 "notes": "KMALLOC_CHECK_DOUBLE_FREE bitmap is maintained in production - only the checks are INVARIANTS-only",
 "recommended_fix": "Unconditional bmap_test refusal before storing to the free ring",
 "fix_status": "compile_validated",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 1,
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)",
 "fix_verdict": "fix.diff (bmap_test + unconditional refusal) compiled and booted in the combined fix kernel; no behavior change for legal frees."
}