{
 "finding_id": "DF-2961",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "corruption",
 "confidence": "certain",
 "verdict": "Confirmed as a force multiplier, not a standalone bug - matching the findings own framing. kobj_lookup_method_cache dispatch (subr_kobj.c:181-188 via KOBJOPLOOKUP) is fully unsynchronized (reads cls->ops, cache slot, ce->desc, indirect-calls ce->func; even WRITES the cache slot on miss at :169), while kobj_class_free kfrees the 2056-byte ops table holding only kobj_token (:206) - a lock the dispatch path never takes - and kobj_init publishes obj->ops with no ordering (:260). All in-tree consumers keep balanced references (subr_bus, libiconv, PCM sound), so no standalone trigger exists; the reachable trigger is consumer-side (DF-2679 family). Fix is architectural (grace period or never-free static classes); no patch compiled - documented per verification contract.",
 "exploit_chain": "",
 "evidence": "subr_kobj.c:181-188 unsynchronized dispatch vs :206 immediate kfree under kobj_token only",
 "kernel_refs": [
  "sys/kern/subr_kobj.c:184",
  "sys/kern/subr_kobj.c:206",
  "sys/kern/subr_kobj.c:260"
 ],
 "poc_changes": "verification deferred to consumer-side DF-2679 per finding text",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 0,
 "guest_dirty": 0,
 "build_cmd": "(none)",
 "run_cmd": "(none)",
 "code_hash": "",
 "notes": "defense-in-depth finding; trigger requires a consumer refcount slip",
 "recommended_fix": "grace period or never-free static classes",
 "fix_status": "not_testable",
 "fix_verdict": "architectural; no patch (documented)"
}