{
 "finding_id": "DF-2885",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "panic",
 "confidence": "likely",
 "verdict": "Line-accurate confirmation, live race attempted at scale, no observable. The tracer-side credential is dereferenced without a reference: PRISON_CHECK(curp->p_ucred, p->p_ucred) at sys_process.c:153 executes before any token, and the ruid compare + caps_priv_check at :202-205 run under only the TARGET p_token while cratom_proc (kern_prot.c:1165-1189) replaces p_ucred under p_spin and crfree()s the old credential. A root racer (sibling thread flipping seteuid 0/1000 every iteration = forced cratom per call) executing 9,700,294 PT_ATTACH attempts against a child produced no crash and no anomaly: the freed-cred read window is a handful of instructions and INVARIANTS does not trap stale reads of objcache memory. The lifetime defect is source-certain; the practical window makes exploitation implausible; fix (crfhold both creds across the permission switch) compiled into the fix-all kernel and ptrace kept working after boot.",
 "exploit_chain": "",
 "evidence": "df2885_run.log: 9700294 attach attempts, 0 errors, race finished without crash",
 "kernel_refs": [
  "sys/kern/sys_process.c:153",
  "sys/kern/sys_process.c:202",
  "sys/kern/kern_prot.c:1183"
 ],
 "poc_changes": "none",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 70,
 "guest_dirty": 0,
 "build_cmd": "cc -o df2885 df2885_ptracecred.c -lpthread",
 "run_cmd": "./df2885 (60s as root)",
 "code_hash": "ee2b170e0faf8575d06edf401dfab554645f15627b0cf9bc31ff393039184357",
 "notes": "Unpriv cred churn vector is itself questionable (setuid to same uid does not replace p_ucred), further shrinking the window; run as root to force cratom churn",
 "recommended_fix": "crfhold tracer and target creds around the kern_ptrace permission switch",
 "fix_status": "not_testable",
 "fix_verdict": "fix compiled in fix-all kernel; ptrace/procfs functional after boot; the race itself cannot be made deterministic"
}