{
 "finding_id": "DF-2971",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "denial_of_service",
 "confidence": "likely",
 "verdict": "Torn whole-struct swaps measured at scale. A module thread alternated ldisc_register(8, A)/ldisc_register(8, B) (two disciplines differing in every function pointer) while a second thread snapshotted the 9-pointer linesw[8] entry WITHOUT tty_token - exactly the lock situation of the real dispatch sites (ttioctl holds t_token+p_token, tty.c:861-862/:1137-1146; drivers hold their own locks). 197,443,116 snapshots: 3,204,559 TORN entries (mixed old/new function pointers in one entry) - the non-atomic publish is directly observable; a dispatcher pairing old l_close with new l_open (TIOCSETD) or entering a disc mid-teardown reads the same torn state. Every transient pointer still points at mapped kernel text, so immediate effect is wrong-disc dispatch/ENODEV; the dangerous residual (execution into freed module text) requires kldunload racing. Dispatch-side snapshot fix documented (row sketch); no kernel patch compiled.",
 "exploit_chain": "",
 "evidence": "run.log DF2971: 197443116 snapshot reads: coherentA=46612515 coherentB=147626042 TORN=3204559",
 "kernel_refs": [
  "sys/kern/tty_conf.c:110",
  "sys/kern/tty_conf.c:127",
  "sys/kern/tty.c:1137"
 ],
 "poc_changes": "torn-read sampler instead of a racing dispatcher (safe observation of the same torn state)",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 15,
 "guest_dirty": 0,
 "build_cmd": "make (KMOD dfv_safe)",
 "run_cmd": "kldload dfv_safe.ko; sysctl -w dfv.t2971=1; dmesg | grep DF2971",
 "code_hash": "8211ab6aada2d050ed579802377f08a3b6aeddeabcc33fd0679d43540120a7f4",
 "notes": "root-initiated mutation; unpriv TIOCSETD churn is the victim side",
 "recommended_fix": "snapshot the linesw entry under tty_token on the dispatch side then dispatch through the snapshot (or RCU/epoch immutable array)",
 "fix_status": "not_testable",
 "fix_verdict": "dispatch-side redesign; documented, not compiled"
}