{
 "finding_id": "DF-2991",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "corruption",
 "confidence": "certain",
 "verdict": "Dead store statically certain, runtime manifestation not injectable. In handle_workitem_freeblocks the loop reads if ((error = indir_trunc(...)) == 0) allerror = error; - allerror is only ever assigned 0, so a non-zero indir_trunc failure can never propagate and the DIAGNOSTIC softdep_error report is unreachable dead code (ffs_softdep.c:2168-2189). Triggering requires a real device I/O error during background indirect-block deallocation, which this guest cannot inject; the one-character fix (!= 0) is compiled into the fix-all kernel.",
 "exploit_chain": "",
 "evidence": "source: ffs_softdep.c:2168-2169 assignment only when == 0; :2188-2189 dead report",
 "kernel_refs": [
  "sys/vfs/ufs/ffs_softdep.c:2168",
  "sys/vfs/ufs/ffs_softdep.c:2188"
 ],
 "poc_changes": "no fault injection available; static proof",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 0,
 "guest_dirty": 0,
 "build_cmd": "(none)",
 "run_cmd": "(none)",
 "code_hash": "",
 "notes": "robustness defect: fs can go inconsistent after transient I/O errors with no kernel indication",
 "recommended_fix": "one-character fix: != 0",
 "fix_status": "not_testable",
 "fix_verdict": "compile-validated in fix-all kernel"
}