{
 "finding_id": "DF-2986",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Reproduced mechanically with a KMOD probe on the stock INVARIANTS guest: a kernel thread was parked in cv_wait (cv_waiters==1, thread blocked), then cv_destroy returned with ZERO diagnostics (spin_uninit is a no-op, spinlock2.h:308-312), and the stale cv identity still woke the waiter afterwards (cv2986 KMOD log). FreeBSDs cv_destroy asserts an empty sleep queue under INVARIANTS; DragonFly has no probe. No memory-safety impact today (_wakeup matches by pointer identity only). Fix: INVARIANTS-gated probe via new tsleep_wchan_busy() helper scanning gd_tsleep_hash; compiled in the F40FIX build.",
 "exploit_chain": "",
 "evidence": "VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff",
 "kernel_refs": [
  "sys/kern/kern_condvar.c:14",
  "sys/sys/spinlock2.h:308",
  "sys/kern/kern_synch.c:1019"
 ],
 "poc_changes": "n/a",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 20,
 "guest_dirty": 0,
 "build_cmd": "see build.sh",
 "run_cmd": "see run.sh",
 "code_hash": "4e59d1189b015a40e960e77c99949710cbb11d87dbc8fe0a01b625a3dc54f6b3",
 "notes": "",
 "recommended_fix": "INVARIANTS-gated cv_destroy waiter probe via tsleep_wchan_busy() (kern_synch.c)",
 "fix_status": "compile_validated",
 "fix_verdict": "compiled in the F40FIX INVARIANTS build (helper tsleep_wchan_busy in kern_synch.c + probe in cv_destroy). Runtime trip not executed (would panic the shared verification kernel); the stock-side missing-diagnostic behavior is what was demonstrated live."
}