{
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "finding": "DF-2938 OBJT_DEVICE device pager never pins the cdev: device teardown (destroy_dev) while a mapping persists -> use-after-free in old_dev_pager_fault (indirect call dev->si_ops->d_mmap through freed cdev) and old_dev_pager_dtor (KKASSERT + NULL write through freed cdev)",
  "reproduce": {
    "build": "sh setup.sh   (in-guest: builds devuaf.ko via bsd.kmod.mk, plus trig/swap/status via cc)",
    "run": "sh /tmp/df2938/orch.sh 0 ; sh /tmp/df2938/orch.sh 1   (cpu arg selects the re-alloc cpu)",
    "expected": "stock: TRIG page1[0]='B' with STATUS last_a_dev==old_chunk (fault served through the destroyed cdev); on chunk re-use (reused=1, observed on cpu 1) the unprivileged munmap panics: assertion \"dev->si_object\" failed in old_dev_pager_dtor at device_pager.c:343. patched (fix.diff): reused always 0, no panic, clean munmap on all cpus."
  },
  "kernel_refs": [
    "sys/vm/device_pager.c:124",
    "sys/vm/device_pager.c:138-141",
    "sys/vm/device_pager.c:146-149",
    "sys/vm/device_pager.c:211",
    "sys/vm/device_pager.c:312-335",
    "sys/vm/device_pager.c:337-346",
    "sys/vm/device_pager.c:348-361",
    "sys/kern/kern_device.c:262-283",
    "sys/vm/vm_mmap.c:1363-1381",
    "sys/vm/vm_mmap.c:1478",
    "sys/dev/sound/pcm/dsp.c:2357",
    "sys/dev/sound/pcm/dsp.c:2505-2508",
    "sys/dev/sound/clone.c:420-434",
    "sys/bus/u4b/uvc/uvc_v4l2.c:763",
    "sys/bus/u4b/uvc/uvc_v4l2.c:783-784"
  ],
  "artifacts": [
    "devuaf.c", "trig.c", "ctl.c", "setup.sh", "orch.sh",
    "run.log", "run.baseline-cpu1.log", "panic.txt",
    "fixed.0.log", "fixed.1.log", "fixed.2.log", "fixed.3.log",
    "fixed.4.log", "fixed.5.log", "env.txt", "fix.diff",
    "VERDICT.md", "manifest.json", "verdict.json"
  ]
}