# DF-2899 - verification verdict

Status: **not_reproduced** | reproduced: 0 | impact: panic | confidence: likely

Line-accurate confirmation; trigger not honestly constructible. fp_mmap (kern_fp.c:473-551) validates a VCHR vnode only by v_type and iszerodev(vp->v_rdev) (pointer compare, kern_memio.c) and unconditionally passes handle=vp to vm_mmap at :550; the syscall-path sibling kern_mmap performs exactly the missing revoked-device check (vm_mmap.c:285-288: v_rdev == NULL -> EBADF) and vm_mmap derefs vp->v_rdev->si_ops->d_uksmap at :1356. The only in-tree route is CKPT_THAW (kern.ckptgroup=0 on this guest = wheel-only) racing device revocation inside one restore - a semi-privileged microsecond race. Fix (mirror the EBADF guard) compiled into the fix-all kernel.

## Evidence pointers
source citations: kern_fp.c:473-550 lacks guard present at vm_mmap.c:285-288; deref at vm_mmap.c:1356

## Kernel references
- sys/kern/kern_fp.c:473
- sys/kern/kern_fp.c:550
- sys/vm/vm_mmap.c:285
- sys/vm/vm_mmap.c:1356

## PoC changes vs the filing sketch
verification skipped per contract; static confirmation only

## Fix
recommendation: mirror the kern_mmap revoked-device guard (EBADF) in fp_mmap

fix status: not_testable

compile-validated in fix-all kernel

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.