{
 "finding_id": "DF-2901",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "panic",
 "confidence": "likely",
 "verdict": "The NULL path is source-certain: kmem_alloc_swapbacked returns NULL on vm_map_find failure (vm_kern.c:127-133 confirmed); hammer2_bulkfree_scan assigns cbinfo.bmap unchecked and cbinfo_bmap_init bzero()s it first thing. The path TO the alloc is unpriv-reachable and that half REPRODUCED live: an unprivileged user (uid=1001) opened a directory on the ROOT hammer2 filesystem and HAMMER2IOC_BULKFREE_SCAN was accepted and executed (sstop=26826768384 = whole volume; size floor 1MB) - the caps gate is absent exactly as catalogued for DF-0815. The NULL itself requires kernel_map KVA exhaustion for a <=1/4-RAM allocation, not constructible on this guest. Fix (NULL check + kfree dedup + ENOMEM) compiled into the fix-all kernel.",
 "exploit_chain": "",
 "evidence": "df2901_run.log: uid=1001 BULKFREE_SCAN ACCEPTED, sstop=26826768384",
 "kernel_refs": [
  "sys/vfs/hammer2/hammer2_bulkfree.c:569",
  "sys/vfs/hammer2/hammer2_bulkfree.c:766",
  "sys/vm/vm_kern.c:127"
 ],
 "poc_changes": "drove the unpriv ioctl on the root hammer2 mount (mount_hammer2 syntax for the scratch rig failed, root fs used instead)",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 30,
 "guest_dirty": 0,
 "build_cmd": "cc -o df2901 df2901.c",
 "run_cmd": "as unpriv: ./df2901 /mnt/h2 (any hammer2 directory)",
 "code_hash": "29a121da3b5494f69488261c3b8f450bdaee866ede40e400e36c78daea9535eb",
 "notes": "unpriv reachability of the allocation path proven; NULL manifestation infeasible",
 "recommended_fix": "NULL-check bmap -> kfree(dedup) + ENOMEM",
 "fix_status": "not_testable",
 "fix_verdict": "compile-validated in fix-all kernel"
}