{
  "finding_id": "DF-2951",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Code-level protocol violation is certain by inspection: sysctl_hostname loads p->p_ucred up to four times (kern_mib.c:222,228,229) with no p_spin/crhold and not via the sanctioned td_ucred (thread.h:279), while cratom_proc (kern_prot.c:1166-1188) replaces and crfrees p_ucred from other threads. Runtime stress on the stock guest could not manifest it: 3x120s of 4 reader threads hammering kern.hostname against 4 jailed-root setgroups churners produced ~3.7e8 reads vs ~4.7e8 credential replacements with zero errors, zero panics, guest healthy after every run. The window is a few adjacent instructions and the freed ucred chunk is typically immediately recycled as the next cratom's cred. Filed Low/likely: realistic impact is a probabilistic panic (jailed-root actor, DF-0181's model); theoretical 256-byte disclosure ceiling if the stale chunk is groomed. Hardening fix: capture td->td_ucred->cr_prison once into pr and use pr->pr_host/pr's sizeof.",
  "exploit_chain": "",
  "evidence": [
    "VERDICT.md: source-level protocol argument (thread.h:279, kern_prot.c:1166-1188, kern_mib.c:221-229)",
    "run.log: 124,072,534 reads / 153,437,435 setgroups, 0 errors, no panic",
    "run.2.log: 119,316,721 reads / 154,727,757 setgroups, 0 errors, no panic",
    "run.3.log: 124,101,906 reads / 158,916,561 setgroups, 0 errors, no panic",
    "build.log: cc 8.3 -O2 -pthread build OK in-guest"
  ],
  "kernel_refs": [
    "sys/kern/kern_mib.c:221-229",
    "sys/kern/kern_prot.c:1166-1188",
    "sys/kern/kern_prot.c:682",
    "sys/sys/thread.h:279",
    "sys/kern/kern_sysctl.c:1447",
    "sys/sys/jail.h:118"
  ],
  "poc_changes": "Authored fresh (no seed): 8-thread pthread stress; counters packed as n + (errs<<40) to survive exit reporting.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 360,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -pthread -o /tmp/stress /tmp/stress_ucred_race.c",
  "run_cmd": "jail / df2951j 127.0.0.5 /tmp/stress 120   (x3, as host root creating the jail; stress runs as jailed uid 0)",
  "code_hash": "e06942b9486508226df3465414cb6183d851250c7d4da10db78e2fc8ba00ef61",
  "notes": "Jailed uid-0 is the only realistic actor (unpriv non-jail cannot replace own p_ucred; jailed root can via setgroups which is allowed in jail and calls cratom_proc unconditionally at kern_prot.c:682). No fix.diff authored: hardening change, no demonstrated runtime impact; suggested row fix in VERDICT.md.",
  "recommended_fix": "In sysctl_hostname (kern_mib.c), replace all p->p_ucred loads with a single pr = td->td_ucred->cr_prison capture and use pr->pr_host / sizeof(pr->pr_host).",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No fix validation performed: the bug did not reproduce at runtime (not_reproduced), so there is no baseline behavior to diff a patched kernel against; the recommended one-line hardening is given in VERDICT.md.",
  "fix_evidence": []
}