# DF-2885 - verification verdict

Status: **not_reproduced** | reproduced: 0 | impact: panic | confidence: likely

Line-accurate confirmation, live race attempted at scale, no observable. The tracer-side credential is dereferenced without a reference: PRISON_CHECK(curp->p_ucred, p->p_ucred) at sys_process.c:153 executes before any token, and the ruid compare + caps_priv_check at :202-205 run under only the TARGET p_token while cratom_proc (kern_prot.c:1165-1189) replaces p_ucred under p_spin and crfree()s the old credential. A root racer (sibling thread flipping seteuid 0/1000 every iteration = forced cratom per call) executing 9,700,294 PT_ATTACH attempts against a child produced no crash and no anomaly: the freed-cred read window is a handful of instructions and INVARIANTS does not trap stale reads of objcache memory. The lifetime defect is source-certain; the practical window makes exploitation implausible; fix (crfhold both creds across the permission switch) compiled into the fix-all kernel and ptrace kept working after boot.

## Evidence pointers
df2885_run.log: 9700294 attach attempts, 0 errors, race finished without crash

## Kernel references
- sys/kern/sys_process.c:153
- sys/kern/sys_process.c:202
- sys/kern/kern_prot.c:1183

## PoC changes vs the filing sketch
none

## Fix
recommendation: crfhold tracer and target creds around the kern_ptrace permission switch

fix status: not_testable

fix compiled in fix-all kernel; ptrace/procfs functional after boot; the race itself cannot be made deterministic

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.