{
 "finding_id": "DF-2985",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "likely",
 "verdict": "Torn/unsynchronized sysent swaps crash the stock kernel 3/3, while coherent entries never do. Calibration: a statically registered probe syscall (variant A: sy_narg=1, returns args[1]) sustained 340,510+ unpriv calls with ZERO anomalies. Enabling the flipper thread (nothing but syscall_register/syscall_deregister alternating two safe constant entries - the stock kern_syscalls.c:67-68/:76 plain 24-byte struct assignments, no locks) crashed the kernel EVERY run, identically, with wild kernel execution: Fatal trap 1 privileged instruction fault, RIP inside module-adjacent text, ddb showing a non-symbolic PC executing garbage (push %cs) - i.e. control flow left every defined entry point. The only difference between the crash-free calibration and the crashes is the unsynchronized sysent[] mutation; no harness fault can redirect a coherent entry (all sy_call values are valid function entry points). The crash machine-reproduces the finding: non-atomic multi-field swaps dispatched unlocked. Caller-side torn-argument counter never printed (kernel died first); one earlier run additionally exhibited the reading form before this harness was hardened (discarded as tainted - see notes).",
 "exploit_chain": "module flipper swaps sysent entry unsynchronized -> userland syscall dispatch interleaves fields -> kernel executes garbage text -> panic (privileged-instruction fault)",
 "evidence": "df2985_panic.txt: Fatal trap 1 privileged instruction fault / Stopped at push %cs; calibration line: calls=340510 torn=0",
 "kernel_refs": [
  "sys/kern/kern_syscalls.c:67",
  "sys/kern/kern_syscalls.c:76",
  "sys/platform/pc64/x86_64/trap.c:1235"
 ],
 "poc_changes": "first flipper attempt crashed with a harness cleanup bug (uninitialized old-entry restore) - discarded; fixed harness (coherent register/deregister pairs only) still crashes 3/3 with constant-safe entries",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 900,
 "guest_dirty": 1,
 "build_cmd": "make (KMOD dfv_safe); cc dfv5call.c",
 "run_cmd": "kldload dfv_safe.ko; sysctl -w dfv.s2985=3; ./dfv5call 5 (calibration); sysctl -w dfv.s2985=2; sysctl -w dfv.s2985=1; ./dfv5call 15 -> kernel panics",
 "code_hash": "8211ab6aada2d050ed579802377f08a3b6aeddeabcc33fd0679d43540120a7f4",
 "notes": "root-timed race with unpriv victim threads; kldunload-frees-module-text half not additionally driven",
 "recommended_fix": "atomic publish (sy_call last, release-store) + dispatch-side re-validation + in-flight quiesce barrier in syscall_deregister",
 "fix_status": "not_testable",
 "fix_verdict": "ordered-publish hardening compiled in fix-all kernel (full quiesce needs a dispatch epoch; partial fix documented)"
}