{
  "finding_id": "DF-2924",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "cmd_get_usage_all() (vfs_quota.c:187/:202) iterates the accounting RB trees and reads ac_bytes/ac_limit without holding ac_spin while vfs_stdaccount (:158-171) and cmd_set_usage_all (:228-268) mutate/rebalance the same trees under the spinlock. RB_NEXT chases rbe_parent pointers, so a concurrent rotation can make the successor walk revisit nodes => traversal cycle => unkillable kernel-mode spin; plus torn 64-bit counter reads. The locking defect is plain in the source; on the guest every attempt to exercise it was masked by DF-2926 (sustained vquotactl traffic exhausts the proplib malloc limit and panics the kernel within ~60 s, at 4096- and 128-entry arrays alike; a 60 s low-rate run did not livelock). Classified likely / not reproduced (confounder documented).",
  "exploit_chain": "",
  "evidence": [
    "README.md result section — DF-2926 panic preempted the measurement both times",
    "source citations: unlocked walk at vfs_quota.c:183-215 vs locked mutation at :158-171 and :228-268"
  ],
  "kernel_refs": [
    "sys/kern/vfs_quota.c:187",
    "sys/kern/vfs_quota.c:202",
    "sys/kern/vfs_quota.c:158-171",
    "sys/kern/vfs_quota.c:228-268"
  ],
  "poc_changes": "Array size reduced 4096->128 for the second attempt to stay under the proplib limit (still hit it).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 180,
  "guest_dirty": 0,
  "build_cmd": "cc -O -o vqlivelock vqlivelock.c -lprop",
  "run_cmd": "/tmp/vqlivelock /boot 60   (unprivileged writer+reader)",
  "code_hash": "bc9e23fc03192321b000a7e57ad5ff43ddcec84a0c426bc3e94f71f6bd0c28e1",
  "notes": "Fix is trivial (take ac_spin around the read walk) and is defense-in-depth regardless of whether the livelock window is ever landed.",
  "recommended_fix": "Hold ac_spin across cmd_get_usage_all()'s tree walk and counter reads (or a seqlock for readers).",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: no baseline reproduction to compare against.",
  "fix_evidence": "README.md"
}