{
 "finding_id": "DF-2913",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "speculative",
 "verdict": "Line-accurate confirmation of the lock-protocol gap (the 2-instruction race window is not triggerable with any reliability and the finding itself is filed Info/speculative): readplimits (kern_plimit.c:98-104) loads p->p_limit under spin_lock_shared(&p->p_spin) but increments p_refcnt in a separate atomic instruction; the COW writers plimit_lwp_fork (:193 region) and plimit_modify (:225 region) store the new p->p_limit WITHOUT p_spin - the spinlock serializes readers against each other, not against the writer, so a cross-process reader (schedcpu -> plimit_testcpulimit -> readplimits) racing a single-threaded targets COW swap could increment a refcount on freed memory if every other reference drained inside the window. The sibling CPU-limit-kill-overflow candidate in the same area was FALSIFIED live earlier (SIGXCPU + survival correct; unsigned predicate in the shipped disassembly - see the pre-existing pack material). Fix (spin_lock p_spin around both COW stores) compiled in the fix kernel which ran the full A/B suite without plimit regressions.",
 "exploit_chain": "",
 "evidence": "sourcenote.txt: reader/writer interleaving analysis; pre-existing pack retains the falsified-candidate evidence",
 "kernel_refs": [
  "sys/kern/kern_plimit.c:98",
  "sys/kern/kern_plimit.c:193",
  "sys/kern/kern_plimit.c:225",
  "sys/kern/kern_synch.c:308"
 ],
 "poc_changes": "none (race not triggerable with reliability)",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 25,
 "guest_dirty": 0,
 "build_cmd": "(source confirmation only)",
 "run_cmd": "(source confirmation only)",
 "code_hash": "f3e55b87be9556f739f41da1b3de09220833ed75443355924f18b549e6001ba9",
 "notes": "Speculative per the filing; the fix makes the protocol match documented intent",
 "recommended_fix": "Hold p_spin around both COW pointer stores",
 "fix_status": "compile_validated",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 1,
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)",
 "fix_verdict": "p_spin-guarded stores compiled and booted; setrlimit/fork exercised throughout the A/B suite without regression."
}