{
 "finding_id": "DF-2988",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "corruption",
 "confidence": "likely",
 "verdict": "The documented contract is not honored - demonstrated with a handshake-orchestrated concurrent scan on a live kernel tree. Scanner thread ran RB_SCAN and parked INSIDE its callback holding node X as its current element; a second thread (playing another concurrent scanner under the shared-lock model the header advertises) RB_REMOVEd X and kfree()d it - no fixup occurs because RB_SCAN_INFO records only the pending-NEXT element (tree.h:302-306; RB_REMOVE advances only inprog->node, tree.h:591-594) - then the scanner resumed and dereferenced the freed node, reading its key through the dangling pointer (UAF read executed; log sequence proves ordering). One run additionally observed the reclaimer marker 0x5a5a5a5a through the dangling pointer (freed block recycled by an unrelated allocation before the parked scanner re-read it) - the full freed-then-reused read. tree.h:708-712 advertises Any item may be deleted while the scan is in progress; the machinery only protects the scanners own current element and parked next elements. No in-tree consumer follows the advertised contract (all deleting consumers serialize exclusively) - API trap. Contract comment fixed in the fix-all tree.",
 "exploit_chain": "",
 "evidence": "run.log DF2988 lines: scanner parked holding node ... deleter RB_REMOVEd + kfreed ... scanner resumed; re-reading freed node; plus 0x5a-marker run",
 "kernel_refs": [
  "sys/sys/tree.h:302",
  "sys/sys/tree.h:591",
  "sys/sys/tree.h:708",
  "sys/sys/tree.h:783"
 ],
 "poc_changes": "finding cites subr_rbtree.c:302-786 but the RB machinery lives in sys/sys/tree.h (subr_rbtree.c is 61 lines of spinlock helpers); paths corrected",
 "attempts": 4,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "build_cmd": "make (KMOD dfv_safe)",
 "run_cmd": "kldload dfv_safe.ko; sysctl -w dfv.rb2988=1; dmesg | grep DF2988",
 "code_hash": "8211ab6aada2d050ed579802377f08a3b6aeddeabcc33fd0679d43540120a7f4",
 "notes": "engine core (rotations/transplant/rebalance) previously proven FreeBSD-identical in pass 2",
 "recommended_fix": "amend the contract + add cur to RB_SCAN_INFO with INVARIANTS KKASSERT in RB_REMOVE",
 "fix_status": "not_testable",
 "fix_verdict": "contract comment fixed in fix-all tree; structural cur-tracking left as upstream design discussion"
}