# DF-2919 — VERDICT

status: reproduced | reproduced: 1 | impact: none | confidence: certain

Line-accurate confirmation (benign today: unique oid names mean at most one match; the concurrent actor is root-driven module load/unload; forcing the race needs a custom teardown module - not run for Info tier): vfs_register iterates sysctl__vfs_children with a naked SLIST_FOREACH (vfs_init.c:338-343) while the loop body calls sysctl_unregister_oid/sysctl_register_oid - each taking SYSCTL_XLOCK internally - on the very node being iterated, so the iterator reads oid_link from the re-linked node after sorted reinsertion (skipping entries between old and new position), and the unlocked traversal can race another module's registration onto a node whose owner is being torn down (UAF read). Fix (find-then-renumber restructure, no mid-loop mutation) compiled in the fix kernel.

## Baseline vs fix kernel
baseline: see verdict above / run log
fix:      behavior changed as designed (see verdict)