--- sys/kern/sysv_shm.c	2026-06-29 12:51:19.000000000 +0000
+++ /tmp/opencode/v26/fixtree/sys/kern/sysv_shm.c	2026-10-24 16:33:07.789715562 +0000
@@ -656,8 +656,18 @@
 	bcopy((caddr_t)p1->p_vmspace->vm_shm, (caddr_t)shmmap_s, size);
 	p2->p_vmspace->vm_shm = (caddr_t)shmmap_s;
 	for (i = 0; i < shminfo.shmseg; i++, shmmap_s++) {
-		if (shmmap_s->shmid != -1)
+		if (shmmap_s->shmid != -1) {
 			shmsegs[IPCID_TO_IX(shmmap_s->shmid)].shm_nattch++;
+		} else if (shmmap_s->reserved) {
+			/*
+			 * DF-2858: fork landed inside the parent's
+			 * sys_shmat reservation window.  Clear the
+			 * transient state or the child permanently
+			 * loses this shmseg slot (nothing will ever
+			 * clear it in the child).
+			 */
+			shmmap_s->reserved = 0;
+		}
 	}
 	lwkt_reltoken(&shm_token);
 }