{
 "finding_id": "DF-2958",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "denial_of_service",
 "confidence": "likely",
 "verdict": "Source-certain, platform-unreachable on this guest: kern_umtx.c:199 crit_enter() ... :216 uservtophys() inside the critical section is confirmed; the pc64 implementation is a lockless PTE read (safe) but the vkernel64 implementation (vkernel64/platform/pmap.c:366-392) calls vm_fault_page(..., VM_FAULT_NORMAL, ...) which can block (vm_wait_pfault/vm_wait paths), violating the LWKT critical-section protocol the tsleep_interlock path requires. A vkernel64 instance cannot be deployed inside the nested QEMU pc64 guest within scope; verification is static. Availability-only, vkernel64 deployments only.",
 "exploit_chain": "",
 "evidence": "kern_umtx.c:199-216 confirmed; blocking fault path in vm_fault.c documented",
 "kernel_refs": [
  "sys/kern/kern_umtx.c:199",
  "sys/kern/kern_umtx.c:216"
 ],
 "poc_changes": "nested vkernel64 not deployable; static verification",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 0,
 "guest_dirty": 0,
 "build_cmd": "(none)",
 "run_cmd": "(none)",
 "code_hash": "",
 "notes": "vkernel64-only DoS",
 "recommended_fix": "non-blocking advisory translation in vkernel64 uservtophys matching pc64 semantics",
 "fix_status": "not_testable",
 "fix_verdict": "vkernel64 pmap fix not authored (out of scope of the pc64 fix-all build); documented"
}