# DF-2885 PoC evidence pack

## What
kern_ptrace reads tracer/target credentials without references while a sibling set*uid churns p_ucred (cratom_proc frees the old cred).

## Build
```
cc -o df2885 df2885_ptracecred.c -lpthread
```

## Run
```
./df2885 (60s as root)
```

## Expected
9.7M PT_ATTACH attempts against cred churn; no crash (window not hit) - run completes with attach counts

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
All logs are full untrimmed captures unless noted. fix.diff is the
git-apply-able verified fix (authored after verification; never applied
to the audit tree).