# DF-2992 - verification verdict

Status: **not_reproduced** | reproduced: 0 | impact: panic | confidence: likely

Line-accurate confirmation of the unlocked re-read: flush_pagedep_deps succeeds in getdirtybuf(&inodedep->id_buf, MNT_WAIT), drops the softdep lock (FREE_LOCK at :4658), then re-loads inodedep->id_buf as the bwrite argument at :4659 - in the window another CPU holding lk can complete the inodes dependencies and free the inodedep or clear id_buf, unlike the sibling softdep_update_inodeblock (:3944-3951) which copies ibp BEFORE FREE_LOCK. The window is a handful of instructions on a path reached by unpriv fsync on files with pending dir-entry deps; a faithful race would need sustained multi-CPU softdep churn for hours with no guarantee - not attempted (Low). Copy-first fix compiled into the fix-all kernel.

## Evidence pointers
source: ffs_softdep.c:4658-4659 vs :3944-3951 discipline divergence

## Kernel references
- sys/vfs/ufs/ffs_softdep.c:4658
- sys/vfs/ufs/ffs_softdep.c:3944

## PoC changes vs the filing sketch
race window not realistically constructible; line-accurate confirmation

## Fix
recommendation: copy id_buf to bp before FREE_LOCK

fix status: not_testable

compile-validated in fix-all kernel (same file as DF-2991)

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.