# DF-2909 - verification verdict

Status: **reproduced** | reproduced: 1 | impact: corruption | confidence: certain

Race reproduced 3/3 runs by unpriv user maxx. Four same-uid processes raced sys_varsym_set(VARSYM_USER, one name) 60000 iterations each; afterwards ONE unset (varsym_set USER name NULL) was issued and varsym_get STILL resolved the name (p2-59997 / p3-59997) - a duplicate shadowed TAILQ entry survived the single delete exactly as claimed (set is two independent lock cycles: varsymmake(name,NULL) remove then varsymmake(name,buf) insert, kern_varsym.c:169-170). Second claim also live-confirmed: varsym_set with level=99 returns 0 silently doing nothing (no default case). Same-credential confusion only; accounting symmetric; no memory unsafety. Fix (default: EINVAL) A/B validated on the fix-all kernel; the atomic-replace half is a larger refactor documented in the pack.

## Evidence pointers
df2909_runs.log: DUPLICATE CONFIRMED after one unset, 3 runs; invalid-level set rc=0

## Kernel references
- sys/kern/kern_varsym.c:169
- sys/kern/kern_varsym.c:152

## PoC changes vs the filing sketch
fixed varsym_get mask semantics (bitmask 1<<level, not level; returns 0 not length)

## Fix
recommendation: atomic replace inside one varsymmake lock cycle + default: EINVAL

fix status: fixed

EINVAL default A/B on fix-all kernel; atomic-replace refactor left as follow-up (duplicates still possible with the minimal fix; behavior change for invalid level verified)

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.