{
 "finding_id": "DF-2889",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "denial_of_service",
 "confidence": "certain",
 "verdict": "Proven on the live kernel by walking the real colored page queues with the exact marker protocol vm_contig_pg_clean itself uses. For PQ_INACTIVE+q, q=1..1023: 2566 pages across 1023 non-empty queues; the buggy :194 predicate (m->queue - m->pc != queue) passes for ZERO of them (m->queue - m->pc is always PQ_INACTIVE for any page in a colored queue, so the predicate reduces to q != 0 and skips every page); the intended predicate (m->queue != queue) passes for all 2566. Control q=0: buggy predicate passes 2/2. Contigmalloc reclaim flush is therefore exactly as ineffective as claimed (colored queues contribute nothing), and each failed pass still walks every queue - the availability amplifier for user-reachable contig paths.",
 "exploit_chain": "",
 "evidence": "run.log DF2889 line: 2566 pages in 1023 queues; buggy predicate passes 0; fixed passes 2566; q=0: 2/2",
 "kernel_refs": [
  "sys/vm/vm_contig.c:194",
  "sys/vm/vm_contig.c:176",
  "sys/vm/vm_contig.c:339"
 ],
 "poc_changes": "harness module replicates the kernel loop read-only against live queues",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 30,
 "guest_dirty": 0,
 "build_cmd": "make -C rig (KMOD dfv_safe)",
 "run_cmd": "kldload smbfs; kldload dfv_safe.ko; sysctl -w dfv.q2889=1; dmesg | grep DF2889",
 "code_hash": "8211ab6aada2d050ed579802377f08a3b6aeddeabcc33fd0679d43540120a7f4",
 "notes": "predicate identity proof: for a page in queue PQ_INACTIVE+q, m->queue-m->pc == PQ_INACTIVE always, so the check equals (q != 0)",
 "recommended_fix": "one-line fix: if (m->queue != queue)",
 "fix_status": "not_testable",
 "fix_verdict": "fix compiled in fix-all kernel; harness proves old predicate mathematically wrong and new predicate correct against the same live queues (both kernels read identical data); end-to-end contigmalloc-under-pressure behavior not additionally driven"
}