{
 "finding_id": "DF-2891",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Line-accurate confirmation: vm_contig_pg_kmap (vm_contig.c:527 region) allocates KVA exclusively from kmem_alloc_pageable(kernel_map, ...) - the map parameter forwarded by contigmalloc_map (:559-581) is never used, and the comment above contigmalloc_map documents the kernel_map-only contract. A future caller passing its own map and freeing through it would kmem_free an address from a map with no entry for it (entry corruption/panic) while the real kernel_map entry leaks. No current caller passes a different map (rg). Fix (KKASSERT map == kernel_map) compiled in the fix kernel.",
 "exploit_chain": "",
 "evidence": "sourcenote.txt: unused-parameter analysis; fix.diff asserts the contract",
 "kernel_refs": [
  "sys/vm/vm_contig.c:527",
  "sys/vm/vm_contig.c:560"
 ],
 "poc_changes": "none",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 15,
 "guest_dirty": 0,
 "build_cmd": "(source confirmation only)",
 "run_cmd": "(source confirmation only)",
 "code_hash": "3d46f0e133d8acef22c665962e6b37b5838fa60026538590c4fb20fec0cf632b",
 "notes": "Latent API trap on an exported symbol",
 "recommended_fix": "KKASSERT(map == kernel_map) or drop the parameter",
 "fix_status": "compile_validated",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 1,
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)",
 "fix_verdict": "Assert compiled and booted; no contigmalloc caller regressed (guest DMA drivers ran through the A/B suite)."
}