{
 "finding_id": "DF-2960",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Line-accurate confirmation (triggering requires a third-party KLD that registers a kcollect callback and unloads - i.e. root; all five in-tree registrants re-verified compiled-in this session): kcollect_register stores the callers RAW const char *id (kern_collect.c:97) and raw kcallback_t (:98) into global arrays with no module-lifetime reference, and kcollect_unregister (:107-115) has zero in-tree callers - nothing enforces it before kldunload. After such an unload the kcollect thread indirect-calls through the dangling callback (:161-164 every 10s) and the sysctl strlen()s the dangling id (:225-227): use-after-free control flow + UAF read. Fix copies the id into fixed internal storage (16-byte slots) compiled in the fix kernel; unregister-before-unload remains a documented mandatory step.",
 "exploit_chain": "KLD registers kcollect callback -> unloads without unregister -> kcollect thread calls dangling pointer every 10s",
 "evidence": "sourcenote.txt: raw-pointer storage + zero-unregister-callers map; fix.diff id copy",
 "kernel_refs": [
  "sys/kern/kern_collect.c:97",
  "sys/kern/kern_collect.c:161",
  "sys/kern/kern_collect.c:225",
  "sys/sys/kcollect.h:98"
 ],
 "poc_changes": "none (root-gated KLD trigger)",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 15,
 "guest_dirty": 0,
 "build_cmd": "(source confirmation only)",
 "run_cmd": "(source confirmation only)",
 "code_hash": "6da80613a8b4c0ae6087af250f1f1a8fcfa644632a7e84c18db7d9143ef24067",
 "notes": "Exported-kernel-API hardening",
 "recommended_fix": "Copy id strings into fixed internal storage and document unregister as a mandatory module-unload step",
 "fix_status": "compile_validated",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 1,
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)",
 "fix_verdict": "Internal-storage copy compiled and booted; kcollect sysctl output unchanged for in-tree registrants."
}