{
 "finding_id": "DF-2899",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "panic",
 "confidence": "likely",
 "verdict": "Line-accurate confirmation; trigger not honestly constructible. fp_mmap (kern_fp.c:473-551) validates a VCHR vnode only by v_type and iszerodev(vp->v_rdev) (pointer compare, kern_memio.c) and unconditionally passes handle=vp to vm_mmap at :550; the syscall-path sibling kern_mmap performs exactly the missing revoked-device check (vm_mmap.c:285-288: v_rdev == NULL -> EBADF) and vm_mmap derefs vp->v_rdev->si_ops->d_uksmap at :1356. The only in-tree route is CKPT_THAW (kern.ckptgroup=0 on this guest = wheel-only) racing device revocation inside one restore - a semi-privileged microsecond race. Fix (mirror the EBADF guard) compiled into the fix-all kernel.",
 "exploit_chain": "",
 "evidence": "source citations: kern_fp.c:473-550 lacks guard present at vm_mmap.c:285-288; deref at vm_mmap.c:1356",
 "kernel_refs": [
  "sys/kern/kern_fp.c:473",
  "sys/kern/kern_fp.c:550",
  "sys/vm/vm_mmap.c:285",
  "sys/vm/vm_mmap.c:1356"
 ],
 "poc_changes": "verification skipped per contract; static confirmation only",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 0,
 "guest_dirty": 0,
 "build_cmd": "(none)",
 "run_cmd": "(none)",
 "code_hash": "",
 "notes": "Low per contract; ceiling NULL-deref panic",
 "recommended_fix": "mirror the kern_mmap revoked-device guard (EBADF) in fp_mmap",
 "fix_status": "not_testable",
 "fix_verdict": "compile-validated in fix-all kernel"
}