{
  "finding_id": "DF-2897",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Deterministic state-machine defect, verified by source walkthrough only (no runtime test; Low severity, root-gated, no memory-safety impact — Phase V not warranted per contract). cnclose()'s muted early-return (sys/kern/tty_cons.c:403-404) skips all bookkeeping, so cn_is_open/cn_phys_is_open survive a /dev/console (or physical-device) close that happens while kern.consmute=1; the subsequent un-mute in sysctl_kern_consmute (tty_cons.c:265-278) then unconditionally re-opens the physical console device (dev_dopen(cn_dev, openflag, openmode,...)) with a stale flags snapshot although no descriptor holds /dev/console, leaving the underlying console device permanently open with no way to close it via /dev/console. Every step is unconditional straight-line code — no race needed.",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-2897/README.md — full four-step deterministic walkthrough with path:line citations and fix sketch"
  ],
  "kernel_refs": [
    "sys/kern/tty_cons.c:403-404",
    "sys/kern/tty_cons.c:415-432",
    "sys/kern/tty_cons.c:265-278",
    "sys/kern/tty_cons.c:241-250"
  ],
  "poc_changes": "not applicable (analysis-only)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Low severity per rubric (requires privileged sysctl toggling around the close). Complements DF-0124 (which covers the unsynchronized *concurrent* RMW of the same flags); this finding is the *sequential* mute-interaction hole and needs no concurrency.",
  "recommended_fix": "Update cn_is_open/cn_phys_is_open before cnclose()'s muted early-return so the un-mute path cannot re-open the physical console device with stale flags for a /dev/console that is no longer open."
}