# DF-2988 - verification verdict

Status: **reproduced** | reproduced: 1 | impact: corruption | confidence: likely

The documented contract is not honored - demonstrated with a handshake-orchestrated concurrent scan on a live kernel tree. Scanner thread ran RB_SCAN and parked INSIDE its callback holding node X as its current element; a second thread (playing another concurrent scanner under the shared-lock model the header advertises) RB_REMOVEd X and kfree()d it - no fixup occurs because RB_SCAN_INFO records only the pending-NEXT element (tree.h:302-306; RB_REMOVE advances only inprog->node, tree.h:591-594) - then the scanner resumed and dereferenced the freed node, reading its key through the dangling pointer (UAF read executed; log sequence proves ordering). One run additionally observed the reclaimer marker 0x5a5a5a5a through the dangling pointer (freed block recycled by an unrelated allocation before the parked scanner re-read it) - the full freed-then-reused read. tree.h:708-712 advertises Any item may be deleted while the scan is in progress; the machinery only protects the scanners own current element and parked next elements. No in-tree consumer follows the advertised contract (all deleting consumers serialize exclusively) - API trap. Contract comment fixed in the fix-all tree.

## Evidence pointers
run.log DF2988 lines: scanner parked holding node ... deleter RB_REMOVEd + kfreed ... scanner resumed; re-reading freed node; plus 0x5a-marker run

## Kernel references
- sys/sys/tree.h:302
- sys/sys/tree.h:591
- sys/sys/tree.h:708
- sys/sys/tree.h:783

## PoC changes vs the filing sketch
finding cites subr_rbtree.c:302-786 but the RB machinery lives in sys/sys/tree.h (subr_rbtree.c is 61 lines of spinlock helpers); paths corrected

## Fix
recommendation: amend the contract + add cur to RB_SCAN_INFO with INVARIANTS KKASSERT in RB_REMOVE

fix status: not_testable

contract comment fixed in fix-all tree; structural cur-tracking left as upstream design discussion

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.