{
 "finding_id": "DF-2906",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "All four unchecked allocation sites confirmed line-accurate in the actual kernel text (the mchain library ships only in smbfs.ko on this system - itself a reachability datapoint: an active SMB session is the context). mb_init/md_init dereference m_gethdr(M_WAITOK) immediately; mb_reserve links m_get(M_WAITOK) and dereferences it; mb_put_mem assigns m_getc(M_WAITOK) into m->m_next then computes M_TRAILINGSPACE(m) on NULL. Injecting objcache back-end failure for M_WAITOK mbuf allocations on a live INVARIANTS guest is not honestly constructible without a fault-injection framework, so the panic form was not forced; the sibling DF-2907 defects in the same file WERE exercised live (see DF-2907, including the m_copym KASSERT panic through md_get_mbuf). Full fix (every allocation checked) compiled into the fix-all kernel and exercised via the md_* paths.",
 "exploit_chain": "",
 "evidence": "static: subr_mchain.c:75-77,131-135,206-210,308-310; runtime paths exercised under DF-2907",
 "kernel_refs": [
  "sys/kern/libmchain/subr_mchain.c:75",
  "sys/kern/libmchain/subr_mchain.c:131",
  "sys/kern/libmchain/subr_mchain.c:206",
  "sys/kern/libmchain/subr_mchain.c:308"
 ],
 "poc_changes": "allocation-failure injection infeasible; relied on line-accurate confirmation + sibling live run",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 0,
 "guest_dirty": 0,
 "build_cmd": "(none)",
 "run_cmd": "(none)",
 "code_hash": "",
 "notes": "FreeBSD stable/12 carries the same pattern; upstream deleted netsmb",
 "recommended_fix": "check every m_get/m_gethdr/m_getc result",
 "fix_status": "not_testable",
 "fix_verdict": "compile-validated in fix-all kernel; md_* paths of the same file A/B validated under DF-2907"
}