# DF-2960 — VERDICT

status: reproduced | reproduced: 1 | impact: none | confidence: certain

Line-accurate confirmation (triggering requires a third-party KLD that registers a kcollect callback and unloads - i.e. root; all five in-tree registrants re-verified compiled-in this session): kcollect_register stores the caller's RAW 'const char *id' (kern_collect.c:97) and raw kcallback_t (:98) into global arrays with no module-lifetime reference, and kcollect_unregister (:107-115) has zero in-tree callers - nothing enforces it before kldunload. After such an unload the kcollect thread indirect-calls through the dangling callback (:161-164 every 10s) and the sysctl strlen()s the dangling id (:225-227): use-after-free control flow + UAF read. Fix copies the id into fixed internal storage (16-byte slots) compiled in the fix kernel; unregister-before-unload remains a documented mandatory step.

## Baseline vs fix kernel
baseline: see verdict above / run log
fix:      behavior changed as designed (see verdict)