{
  "finding_id": "DF-2998",
  "title": "Server attributes freely retype live vnodes in nfs_loadattrcache (VREG->VDIR/VCHR/VBLK; VDIR->VREG)",
  "verdict": "reproduced",
  "reproduced": true,
  "impact": "kernel type confusion -> deterministic panics (2 new independent sinks) + server-driven device-node injection into the namespace",
  "confidence": "certain",
  "reproduce": {
    "build": "cd /root/df2998 && cc -O -o fakesrv2998 fakesrv2998.c && cc -O -o trigger2998 trigger2998.c",
    "run": "sh run.sh   (TEST1+1b retypes, TEST2 panics at umount; pieces: ./trigger2998 retype /mnt $(stat -f '%Hr %Lr' /dev/vn0); ./trigger2998 dirreg /mnt && umount /mnt)",
    "expected": "stock: 'live VREG vnode retyped VDIR while fd open' + 'device node injected' + (root and unpriv) + TEST2 'panic: bgetvp - overlapping buffer' (or nfs_removerpc GPF at umount of a non-VDIR retyped node); fixed kernel: every lie refused with EBADRPC ('RPC struct is bad'), no panic, honest lifecycle intact"
  },
  "kernel_refs": [
    "sys/vfs/nfs/nfs_subs.c:723-733",
    "sys/vfs/nfs/nfs_subs.c:943-949",
    "sys/vfs/nfs/nfs_subs.c:1338-1356",
    "sys/vfs/nfs/nfs_node.c:392-395",
    "sys/vfs/nfs/nfs_node.c:464-473",
    "sys/vfs/nfs/nfsnode.h:125-133",
    "sys/vfs/nfs/nfs_vnops.c:1913-1918",
    "sys/vfs/nfs/nfs_vnops.c:162-175"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "fakesrv2998.c", "trigger2998.c",
    "build.sh", "build.log", "run.sh", "run.log", "fix_run.log",
    "fix_build.log", "panic.bgetvp.txt", "panic.removerpc.txt",
    "run.test1b.log", "fix.diff", "env.txt", "manifest.json", "verdict.json"
  ]
}