{
 "finding_id": "DF-2864",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Line-accurate confirmation (boot-time only; a runtime demo would require failing root-mount candidates at boot via loader config - disproportionate for the Info tier): in the vfs_mountroot_try candidate loop (vfs_conf.c:435-462), a failed VFS_MOUNT leaves the vfs_rootmountallocd mp alive when the next iteration overwrites mp - each failed candidate leaks a struct mount with a LIVE syncer kernel thread (mount_init -> vn_syncer_thr_create, vfs_mount.c:380-390), shared-locked mnt_lock and mnt_hold=1; the final error path (:505-511) kfrees the last mp but never drops mp->mnt_vfc->vfc_refcount (contrast vfs_conf.c:375) - the fstype stays permanently pinned and vfsconf_remove refuses module unload. Bounded by candidate count; root/loader-driven only. Fix (in-loop teardown + refcount drop) compiled in the fix kernel.",
 "exploit_chain": "",
 "evidence": "sourcenote.txt: loop + error-path teardown analysis vs the devfs reference teardown",
 "kernel_refs": [
  "sys/kern/vfs_conf.c:435",
  "sys/kern/vfs_conf.c:461",
  "sys/kern/vfs_conf.c:508",
  "sys/kern/vfs_mount.c:389"
 ],
 "poc_changes": "none",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 20,
 "guest_dirty": 0,
 "build_cmd": "(source confirmation only)",
 "run_cmd": "(source confirmation only)",
 "code_hash": "79e0ba72a3a2806814ba7b63a67d4e6638969ce7e14df0a1932835c518f74508",
 "notes": "Boot-time resource leak; no unprivileged reachability",
 "recommended_fix": "Tear down the failed mp inside the loop and drop vfc_refcount on the error path",
 "fix_status": "compile_validated",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 1,
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)",
 "fix_verdict": "Teardown fix compiled and booted (the fix kernel mounted its root through the patched path)."
}