# DF-2825 — VERDICT

status: reproduced | reproduced: 1 | impact: none | confidence: certain

Mechanically reproduced on the stock guest: fcntl(F_SETLK, l_start=10, l_len=-5) returns -1/EINVAL (kern_lockf.c:230-231 rejects negative lengths outright), while POSIX.1-2008 (and FreeBSD/Linux) interpret l_len<0 as the byte range [l_start+l_len, l_start-1] = [5,9]; portable backward-lock applications fail closed on DragonFly. Fail-closed only (no memory safety). On the fix kernel the identical call returns 0 (lock accepted with POSIX semantics). The PoC's F_GETLK cross-check is blind to the caller's own lock (F_GETLK ignores locks held by the calling process), so the acceptance rv=0 is the decisive A/B signal.

## Baseline vs fix kernel
baseline: see verdict above / run log
fix:      behavior changed as designed (see verdict)