{
  "finding_id": "DF-2996",
  "title": "nfs_sillyrename stores sp through an unvalidated nfsnode (ignored error, uninitialized np, unvalidated identity/type) — wild write / VDIR cookie-list type confusion, deterministic kernel panic",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "cd /root/df2996 && cc -O -o fakesrv fakesrv.c && cc -O -o t2 t2.c && cc -O -o trigger trigger.c",
    "run": "cd /root/df2996 && (./fakesrv dirfh > /root/fs.log 2>&1 &) && sleep 1 && mount_nfs -o port=2049,udp,retrycnt=1 127.0.0.1:/P /mnt && mkdir /mnt/d && ./t2 unlink",
    "expected": "stock kernel: trigger prints fd/unlink lines then guest dies with 'Fatal trap 12' at nfs_reclaim+0x150 (fault address 0x1); mode err: unlink silently returns 0 with a wild write executed; fixed kernel (fix.diff v2): err/control clean, sp store eliminated (note: v2's rejection path itself panics in dirfh mode — see VERDICT.md)"
  },
  "kernel_refs": [
    "sys/vfs/nfs/nfs_vnops.c:3036-3038",
    "sys/vfs/nfs/nfs_vnops.c:3075-3098",
    "sys/vfs/nfs/nfsnode.h:125-133",
    "sys/vfs/nfs/nfs_node.c:466-473",
    "sys/vfs/nfs/nfs_subs.c:718-731"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "fakesrv.c", "trigger.c", "t2.c", "lsdir.c",
    "build.sh", "run.sh", "push.sh", "panic.txt", "ddb.trace.txt",
    "run.baseline.log", "run.fixed.log", "env.txt", "fix.diff",
    "verdict.json", "manifest.json"
  ]
}