{
 "finding_id": "DF-2992",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "panic",
 "confidence": "likely",
 "verdict": "Line-accurate confirmation of the unlocked re-read: flush_pagedep_deps succeeds in getdirtybuf(&inodedep->id_buf, MNT_WAIT), drops the softdep lock (FREE_LOCK at :4658), then re-loads inodedep->id_buf as the bwrite argument at :4659 - in the window another CPU holding lk can complete the inodes dependencies and free the inodedep or clear id_buf, unlike the sibling softdep_update_inodeblock (:3944-3951) which copies ibp BEFORE FREE_LOCK. The window is a handful of instructions on a path reached by unpriv fsync on files with pending dir-entry deps; a faithful race would need sustained multi-CPU softdep churn for hours with no guarantee - not attempted (Low). Copy-first fix compiled into the fix-all kernel.",
 "exploit_chain": "",
 "evidence": "source: ffs_softdep.c:4658-4659 vs :3944-3951 discipline divergence",
 "kernel_refs": [
  "sys/vfs/ufs/ffs_softdep.c:4658",
  "sys/vfs/ufs/ffs_softdep.c:3944"
 ],
 "poc_changes": "race window not realistically constructible; line-accurate confirmation",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 0,
 "guest_dirty": 0,
 "build_cmd": "(none)",
 "run_cmd": "(none)",
 "code_hash": "",
 "notes": "rare panic rather than controllable corruption per finding",
 "recommended_fix": "copy id_buf to bp before FREE_LOCK",
 "fix_status": "not_testable",
 "fix_verdict": "compile-validated in fix-all kernel (same file as DF-2991)"
}