# DF-2901 - verification verdict

Status: **not_reproduced** | reproduced: 0 | impact: panic | confidence: likely

The NULL path is source-certain: kmem_alloc_swapbacked returns NULL on vm_map_find failure (vm_kern.c:127-133 confirmed); hammer2_bulkfree_scan assigns cbinfo.bmap unchecked and cbinfo_bmap_init bzero()s it first thing. The path TO the alloc is unpriv-reachable and that half REPRODUCED live: an unprivileged user (uid=1001) opened a directory on the ROOT hammer2 filesystem and HAMMER2IOC_BULKFREE_SCAN was accepted and executed (sstop=26826768384 = whole volume; size floor 1MB) - the caps gate is absent exactly as catalogued for DF-0815. The NULL itself requires kernel_map KVA exhaustion for a <=1/4-RAM allocation, not constructible on this guest. Fix (NULL check + kfree dedup + ENOMEM) compiled into the fix-all kernel.

## Evidence pointers
df2901_run.log: uid=1001 BULKFREE_SCAN ACCEPTED, sstop=26826768384

## Kernel references
- sys/vfs/hammer2/hammer2_bulkfree.c:569
- sys/vfs/hammer2/hammer2_bulkfree.c:766
- sys/vm/vm_kern.c:127

## PoC changes vs the filing sketch
drove the unpriv ioctl on the root hammer2 mount (mount_hammer2 syntax for the scratch rig failed, root fs used instead)

## Fix
recommendation: NULL-check bmap -> kfree(dedup) + ENOMEM

fix status: not_testable

compile-validated in fix-all kernel

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.