{
  "finding_id": "DF-2984",
  "title": "syscall_deregister() unvalidated sysent[*offset] write via MOD_LOAD-failure rollback: live syscall slot destroyed -> unprivileged persistent NULL-call kernel panic; EINVAL/ENFILE variants give arbitrary-index and sysent[-1] 24-byte zero writes",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "sh /tmp/df2984/build.sh   (in-guest, root; KLDs vs /usr/obj/usr/src/sys/X86_64_GENERIC + cc call210.c)",
    "run": "root: sh /tmp/df2984/run.sh ; then any user: /tmp/df2984/call210",
    "expected": "kldload A rc=0 (slot live, call210=4242); kldload B rc=0 + dmesg 'MOD_LOAD (dfpocb,...) error 17'; unprivileged call210 -> 'Fatal trap 12: page fault while in kernel mode', fault va=0x0, RIP=0x8:0x0, guest down; on fix.diff kernel #1 the identical sequence leaves slot live (call210=4242, guest up)"
  },
  "kernel_refs": [
    "sys/kern/kern_syscalls.c:72-78",
    "sys/kern/kern_syscalls.c:99-106",
    "sys/kern/kern_module.c:110-116",
    "sys/platform/pc64/x86_64/trap.c:1285"
  ],
  "fix_status": "fixed",
  "artifacts": [
    "README.md", "VERDICT.md", "modA/dfpoc_a.c", "modA/Makefile",
    "modB/dfpoc_b.c", "modB/Makefile", "modC/dfpoc_c.c", "modC/Makefile",
    "call210.c", "build.sh", "run.sh", "build.log", "run.log",
    "run.modc.log", "panic.txt", "run.fix.log", "fix_run.log", "fix_build.log", "fix_build_kld.log", "env.txt", "fix.diff",
    "verdict.json", "manifest.json"
  ]
}