{
 "finding_id": "DF-2989",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Reproduced with a userland program compiled against the same RB_GENERATE macros from sys/sys/tree.h (RB_SCAN_LOCK no-ops outside _KERNEL): after corrupting the tree head rbh_inprog to an unrelated chain that does not contain the live scan, name##_scan_info_done (tree.h:730-740) walks while (*infopp != scan) infopp = &(*infopp)->link; past the chain end and SIGSEGVs (demo2, exit 139; healthy demo1 clean). In-kernel this is an unkillable wild-pointer traversal; the engine itself (tree.h:460-870) contains no assertion of any kind even under INVARIANTS. Fix: NULL-exit walk + skip-unlink when absent (compile-validated in F40FIX; the full red/black validator is recommended upstream work). The DF-2988 rig demonstrated the motivating consumer-side engine misuse on this guest.",
 "exploit_chain": "",
 "evidence": "VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff",
 "kernel_refs": [
  "sys/sys/tree.h:730",
  "sys/sys/tree.h:460",
  "sys/sys/tree.h:740"
 ],
 "poc_changes": "initial demo registered the scan AFTER corrupting the list (scan_info_link overwrote the corruption and the walk passed); fixed by hijacking rbh_inprog after scan registration",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 20,
 "guest_dirty": 0,
 "build_cmd": "see build.sh",
 "run_cmd": "see run.sh",
 "code_hash": "328441679a63f93b4db5de658d9b55243cc5335e41e1011eb859ef673da5743f",
 "notes": "",
 "recommended_fix": "NULL-terminated scan_info_done walk; do not touch a corrupted inprog list",
 "fix_status": "fixed",
 "fix_verdict": "A/B complete (userland mirror compiled against the same macros): the hijacked-inprog demo returns cleanly on the fixed tree.h (stock SIGSEGV, exit 139); healthy-scan demo unaffected. Shipped fix uses the portable no-KKASSERT form (tree.h is also a userland header - sbin/hammer includes it)."
}