{
 "finding_id": "DF-2969",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "denial_of_service",
 "confidence": "speculative",
 "verdict": "Protocol violation confirmed statically; the claimed hang REFUTED live. The harness created a kthread that immediately kthread_exit()ed, then called suspend_kproc(dead_td, 0) - the log shows the full sequence (atomic_set_int on the parked thread = the stale write, wakeup/tsleep on a dead identity), but suspend_kproc RETURNED: the exit path clears or the allocator recycles td_mpflags before the while-test, so the unkillable-sleeper never materialized; a second suspend_kproc on a LIVE kthread also completed (kpsus_token not wedged). No in-tree trigger exists (finding itself says speculative). Fix (lwkt_hold/drop bracket) compiled into the fix-all kernel.",
 "exploit_chain": "",
 "evidence": "df2969_run.log: suspend_kproc returned?! + live suspend_kproc returned (kpsus_token not held?)",
 "kernel_refs": [
  "sys/kern/kern_kthread.c:188",
  "sys/kern/kern_kthread.c:194",
  "sys/kern/kern_kthread.c:200"
 ],
 "poc_changes": "drove the exact claimed call shape (timo=0 on an exited kthread); hang did not occur",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "build_cmd": "make (KMOD dfv_2969)",
 "run_cmd": "kldload dfv_2969.ko; sysctl -w dfv69.s2969=1; sysctl -w dfv69.s2969x=1; ps",
 "code_hash": "38eaaaa1803d8e2ae2a6bc8268a14d32267150ed7c91d1582b17d9080b5539c4",
 "notes": "the stale-identity write executed; observable consequence none under test conditions",
 "recommended_fix": "lwkt_hold/lwkt_rele bracket + TDF_EXITING re-check",
 "fix_status": "not_testable",
 "fix_verdict": "compile-validated in fix-all kernel"
}