{
 "finding_id": "DF-2943",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Line-accurate confirmation re-verified by rg this session: sysref_init (kern_sysref.c:105-125) has ZERO callers (prototype only, sysref2.h:122) and initializes neither SRF_ALLOCATED nor objcache backing - a future caller that sysref_puts such an object walks to final release where the only guards are the INVARIANTS KKASSERT (:347) and a production-build objcache_put of a pointer that never came from the cache (:349-353) - an arbitrary-free-shaped footgun behind an unused export. allocsysid (:362-373) also has zero callers; no class sets SRC_MANAGEDINIT; SRF_SYSIDUSED is never set (objcache_dtor branch :350-351 unreachable). Fix retires sysref_init and allocsysid (+ prototypes); compiled in the fix kernel.",
 "exploit_chain": "",
 "evidence": "sourcenote.txt: dead-symbol map; fix.diff deletions",
 "kernel_refs": [
  "sys/kern/kern_sysref.c:105",
  "sys/kern/kern_sysref.c:347",
  "sys/kern/kern_sysref.c:362",
  "sys/sys/sysref2.h:122"
 ],
 "poc_changes": "none",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 15,
 "guest_dirty": 0,
 "build_cmd": "(source confirmation only)",
 "run_cmd": "(source confirmation only)",
 "code_hash": "5165dd67505df71638252a70ef036707cfce1961762295a652bd1af95af127aa",
 "notes": "Dead exported surface; retire or guard",
 "recommended_fix": "Remove sysref_init/allocsysid and their prototypes (or add always-on guards)",
 "fix_status": "compile_validated",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 1,
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)",
 "fix_verdict": "Deletions compiled and booted; no in-tree reference to either symbol."
}