{
 "finding_id": "DF-2909",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "corruption",
 "confidence": "certain",
 "verdict": "Race reproduced 3/3 runs by unpriv user maxx. Four same-uid processes raced sys_varsym_set(VARSYM_USER, one name) 60000 iterations each; afterwards ONE unset (varsym_set USER name NULL) was issued and varsym_get STILL resolved the name (p2-59997 / p3-59997) - a duplicate shadowed TAILQ entry survived the single delete exactly as claimed (set is two independent lock cycles: varsymmake(name,NULL) remove then varsymmake(name,buf) insert, kern_varsym.c:169-170). Second claim also live-confirmed: varsym_set with level=99 returns 0 silently doing nothing (no default case). Same-credential confusion only; accounting symmetric; no memory unsafety. Fix (default: EINVAL) A/B validated on the fix-all kernel; the atomic-replace half is a larger refactor documented in the pack.",
 "exploit_chain": "",
 "evidence": "df2909_runs.log: DUPLICATE CONFIRMED after one unset, 3 runs; invalid-level set rc=0",
 "kernel_refs": [
  "sys/kern/kern_varsym.c:169",
  "sys/kern/kern_varsym.c:152"
 ],
 "poc_changes": "fixed varsym_get mask semantics (bitmask 1<<level, not level; returns 0 not length)",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 300,
 "guest_dirty": 0,
 "build_cmd": "cc -o df2909 df2909_varsymrace.c",
 "run_cmd": "as unpriv: ./df2909",
 "code_hash": "04bd5d4e8c184a375b8879681c909bf18fb9ea1fdc339904e0f5ee3378989766",
 "notes": "VARSYM_USER set is per-uid (ui_varsymset) so plain processes of one uid race it",
 "recommended_fix": "atomic replace inside one varsymmake lock cycle + default: EINVAL",
 "fix_status": "fixed",
 "fix_verdict": "A/B on fix kernel #2: invalid level returns EINVAL (stock rc=0); varsym set/get regression-checked functional. Minimal fix covers the EINVAL half; atomic-replace refactor still needed for the duplicate-shadowing half.",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0
}