{
  "finding_id": "DF-2929",
  "verdict": "reproduced",
  "impact": "panic (timer-queue memory corruption; wild unlink on production kernels)",
  "confidence": "certain",
  "reproduce": {
    "build": "guest# mkdir -p /root/df2929; cp df2929_mod.c ...; Makefile (KMOD=df2929, SRCS=df2929_mod.c, COPTS+=-I/usr/src/sys/dev/drm/include); cd /root/df2929 && make && kldload ./df2929.ko",
    "run": "guest# sysctl kern.df2929_run=1   (control -> 'queue ok')\n         sysctl kern.df2929_run=2   (raw engine re-init -> 'QUEUE CORRUPT' + panic in systimer_del)\n         sysctl kern.df2929_run=5   (real hrtimer_start_range_ns path -> panic in systimer_intr)",
    "expected": "baseline: 'DF2929 mode=2: forward hops=24 seen_st=8 seen_p=8 ... => QUEUE CORRUPT' then panic: Bad link elm ... prev->next != elm (systimer_del+0xd4 / systimer_intr+0x235 <- pcpu_timer_process_oncpu <- splz_timer); fix build: 'queue ok' x8, dht_fires=+1 per run, no panic"
  },
  "kernel_refs": [
    "sys/kern/kern_systimer.c:363",
    "sys/kern/kern_systimer.c:148",
    "sys/kern/kern_systimer.c:359-371",
    "sys/dev/drm/linux_hrtimer.c:88-119",
    "sys/dev/drm/i915/intel_uncore.c:74-78",
    "sys/dev/drm/i915/intel_uncore.c:1165-1176"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "df2929_mod.c", "df2929_ppollrace.c",
    "build.sh", "run.sh", "build.log", "run.log", "run.2.log", "run.fix.log",
    "panic.txt", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}