# DF-2909 PoC evidence pack

## What
sys_varsym_set replace is a non-atomic remove-then-insert; invalid levels silently succeed.

## Build
```
cc -o df2909 df2909_varsymrace.c
```

## Run
```
as unpriv: ./df2909
```

## Expected
3/3 runs: DUPLICATE CONFIRMED (value survives a single unset); invalid level returns 0

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
All logs are full untrimmed captures unless noted. fix.diff is the
git-apply-able verified fix (authored after verification; never applied
to the audit tree).