# DF-2985 - verification verdict

Status: **reproduced** | reproduced: 1 | impact: panic | confidence: likely

Torn/unsynchronized sysent swaps crash the stock kernel 3/3, while coherent entries never do. Calibration: a statically registered probe syscall (variant A: sy_narg=1, returns args[1]) sustained 340,510+ unpriv calls with ZERO anomalies. Enabling the flipper thread (nothing but syscall_register/syscall_deregister alternating two safe constant entries - the stock kern_syscalls.c:67-68/:76 plain 24-byte struct assignments, no locks) crashed the kernel EVERY run, identically, with wild kernel execution: Fatal trap 1 privileged instruction fault, RIP inside module-adjacent text, ddb showing a non-symbolic PC executing garbage (push %cs) - i.e. control flow left every defined entry point. The only difference between the crash-free calibration and the crashes is the unsynchronized sysent[] mutation; no harness fault can redirect a coherent entry (all sy_call values are valid function entry points). The crash machine-reproduces the finding: non-atomic multi-field swaps dispatched unlocked. Caller-side torn-argument counter never printed (kernel died first); one earlier run additionally exhibited the reading form before this harness was hardened (discarded as tainted - see notes).

## Evidence pointers
df2985_panic.txt: Fatal trap 1 privileged instruction fault / Stopped at push %cs; calibration line: calls=340510 torn=0

## Kernel references
- sys/kern/kern_syscalls.c:67
- sys/kern/kern_syscalls.c:76
- sys/platform/pc64/x86_64/trap.c:1235

## PoC changes vs the filing sketch
first flipper attempt crashed with a harness cleanup bug (uninitialized old-entry restore) - discarded; fixed harness (coherent register/deregister pairs only) still crashes 3/3 with constant-safe entries

## Fix
recommendation: atomic publish (sy_call last, release-store) + dispatch-side re-validation + in-flight quiesce barrier in syscall_deregister

fix status: not_testable

ordered-publish hardening compiled in fix-all kernel (full quiesce needs a dispatch epoch; partial fix documented)

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.