# DF-2939 - verification verdict

Status: **not_reproduced** | reproduced: 0 | impact: panic | confidence: likely

Line-accurate confirmation; no trigger surface on this guest. dev_pager_dealloc runs cdev_pg_dtor (device_pager.c:211) BEFORE taking dev_pager_mtx and unlinking (:213-215); old_dev_pager_dtor does KKASSERT(dev->si_object) then dev->si_object = NULL unlocked (:343); cdev_pager_allocate sets dev->si_object under the mutex (:146-149) - the clobber window is real. But the old pager is only used by legacy d_mmap devices, and the guest has none (only nvmm with .d_mmap = nommap; no DRM/vga). Window is a few instructions wide even where devices exist. Fix (move si_object bookkeeping under dev_pager_mtx after unlist, conditional on identity) compiled into the fix-all kernel.

## Evidence pointers
source ordering: device_pager.c:211 vs :213-215 vs :146-149 vs :343

## Kernel references
- sys/vm/device_pager.c:211
- sys/vm/device_pager.c:146
- sys/vm/device_pager.c:343

## PoC changes vs the filing sketch
no legacy d_mmap device present on guest

## Fix
recommendation: si_object bookkeeping under dev_pager_mtx after unlist (conditional == object clear)

fix status: not_testable

compile-validated in fix-all kernel

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.