# DF-2889 - verification verdict

Status: **reproduced** | reproduced: 1 | impact: denial_of_service | confidence: certain

Proven on the live kernel by walking the real colored page queues with the exact marker protocol vm_contig_pg_clean itself uses. For PQ_INACTIVE+q, q=1..1023: 2566 pages across 1023 non-empty queues; the buggy :194 predicate (m->queue - m->pc != queue) passes for ZERO of them (m->queue - m->pc is always PQ_INACTIVE for any page in a colored queue, so the predicate reduces to q != 0 and skips every page); the intended predicate (m->queue != queue) passes for all 2566. Control q=0: buggy predicate passes 2/2. Contigmalloc reclaim flush is therefore exactly as ineffective as claimed (colored queues contribute nothing), and each failed pass still walks every queue - the availability amplifier for user-reachable contig paths.

## Evidence pointers
run.log DF2889 line: 2566 pages in 1023 queues; buggy predicate passes 0; fixed passes 2566; q=0: 2/2

## Kernel references
- sys/vm/vm_contig.c:194
- sys/vm/vm_contig.c:176
- sys/vm/vm_contig.c:339

## PoC changes vs the filing sketch
harness module replicates the kernel loop read-only against live queues

## Fix
recommendation: one-line fix: if (m->queue != queue)

fix status: not_testable

fix compiled in fix-all kernel; harness proves old predicate mathematically wrong and new predicate correct against the same live queues (both kernels read identical data); end-to-end contigmalloc-under-pressure behavior not additionally driven

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.