# DF-2881 - verification verdict

Status: **reproduced** | reproduced: 1 | impact: corruption | confidence: certain

Duplicate-swap check bypass reproduced on the stock kernel. Control: re-swapon of /dev/vbd0s1b is rejected with Device already in use (sp->sw_vp == vp matches, vm_swap.c:281). The guest vbd driver creates no serno slice-alias nodes, so the exact same-cdev two-vnode form is not constructible here; the identical check weakness was demonstrated with the whole-disk and compat-slice nodes of one vn disk: swapon /dev/vn0 AND swapon /dev/vn0s0 were BOTH accepted (rc=0 each) installing two interleaved 4194304-block swap stripes over the SAME physical blocks (swapinfo shows both). Pageouts to the two stripes interleave onto overlapping offsets - one process swapped pages overwrite another process swap blocks, silent cross-process corruption, exactly the claimed consequence class. Root-only, operator-mistake threat model; cleaned up immediately (both swapoff).

## Evidence pointers
df2881_run2.log: swapon /dev/vn0 rc=0 + swapon /dev/vn0s0 rc=0 + swapinfo showing both devices over the same 2G backing file; control EBUSY in df2881_run.log

## Kernel references
- sys/vm/vm_swap.c:281
- sys/vm/vm_swap.c:426
- sys/vm/vm_swap.c:354

## PoC changes vs the filing sketch
serno alias slice nodes absent on vbd; used whole-disk + compat-slice overlap of one vn disk instead (same vnode-identity check bypass)

## Fix
recommendation: sys/vm/vm_swap.c: also reject a swap device whose underlying storage identity (devid) is already active

fix status: not_testable

cdev-identity check compiled into the fix-all kernel; the demonstrated whole-disk/slice overlap uses two different cdevs covering the same blocks, so the check does not (and cannot) catch it; honest fix needs storage-range comparison

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.