{
  "finding_id": "DF-2831",
  "title": "dssize/diskpsize consume dp->d_slice without ds_token (UAF walk + missing revalidation); DSO_RAWPSIZE fallback then substitutes whole-disk size for partition devices",
  "verdict": "reproduced",
  "impact": "panic",
  "severity": "Medium",
  "bucket": "memcorrupt",
  "reproduce": {
    "build": "sh build.sh  (guest, root: cc -O -o genimg2831/poc2831/poc2831b + genimg)",
    "run": "sh run.sh     (vnconfig + control run + two 2000-iteration race runs)",
    "expected": "stock kernel: control 2000/2000 clean size 4096; race runs report ok_WRONG_SIZE 125-285 of 2000 (swapinfo 16384 blocks, whole-disk size, while in-core label still says 4096); instrumented stock kernel dies with fatal trap 12 in dssize+0x15c; fix kernel: ok_WRONG_SIZE=0, clean ENXIO failures only, no panic"
  },
  "kernel_refs": [
    "sys/kern/subr_diskslice.c:849-870",
    "sys/kern/subr_diskslice.c:761-777",
    "sys/kern/subr_disk.c:1259-1276",
    "sys/kern/subr_disk.c:1270-1274",
    "sys/kern/subr_disk.c:367-368",
    "sys/kern/subr_disk.c:494",
    "sys/vm/vm_swap.c:307-317",
    "sys/dev/disk/vn/vn.c:579"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "env.txt",
    "genimg2831.c", "poc2831.c", "poc2831b.c",
    "build.sh", "run.sh",
    "run.log", "fix_run.log", "panic.txt",
    "instrument.diff", "fixinst.diff", "fix.diff",
    "manifest.json", "verdict.json"
  ]
}