# DF-3007 VERDICT

**Status: not_reproduced — the NULL-deref is real by construction but the code path is dead on a stock DragonFly system. Severity Info (latent).**

## The bug (certain, by code reading)

`sys/vfs/devfs/devfs_core.c:2751`:

```c
	devfs_msg_send(DEVFS_TERMINATE_CORE, NULL);
```

`devfs_msg_send` (`devfs_core.c:1112-1119`) unconditionally does:

```c
	lwkt_initmsg(&devfs_msg->hdr, &devfs_dispose_port, 0);
	devfs_msg->hdr.u.ms_result = cmd;
```

`struct devfs_msg` begins with `struct lwkt_msg hdr` (`sys/sys/devfs.h:165`),
so `&NULL->hdr == NULL`, and `lwkt_initmsg` (`sys/sys/msgport2.h:33-38`)
writes `msg->ms_flags` and `msg->ms_reply_port` — i.e. **two stores to
address 0**, followed by `lwkt_sendmsg(port, NULL)`. Any execution panics.

## Runtime reachability — traced dead on this guest

1. `devfs_uninit` is registered by
   `SYSUNINIT(vfs_devfs_register, SI_SUB_DEVFS_CORE, SI_ORDER_ANY, ...)` at
   `devfs_core.c:2805-2806`.
2. DragonFly's boot code (`sys/kern/init_main.c:200-270`, `mi_startup`) walks
   only `sysinit_set`; the static `sysuninit_set` has **no consumer anywhere
   in the kernel** — grep of `sys/kern` finds `sysuninit` executed only in
   `linker_file_sysuninit` (`sys/kern/kern_linker.c:188-198,535`), which is
   called from `linker_file_unload` for KLD modules only.
3. devfs is compiled into the stock kernel (`vfs.root` uses it; the devfs
   module cannot be unloaded — it owns /dev). Therefore `devfs_uninit` never
   runs on this system.
4. Empirical: two `shutdown -r now` cycles on the guest — no panic, clean
   reboot to `login:` both times (`run.log`).

Classification per the honest table: "expected marker absent, run exits 0,
guest stays up" -> not_reproduced, impact none. The finding is kept because
the code is objectively broken and would fire instantly if anyone ever makes
devfs unloadable or adds a sysuninit walker (FreeBSD-style shutdown runs
SYSUNINITs; DF ports of that machinery would trip this).

## Fix validation

Not applicable beyond compilation: the path cannot be executed on this
system (that is the finding itself). `fix.diff` was applied in the guest
`/usr/src` and compiled in the patched kernel build (build log `/tmp/kbuild.log`
in guest) — it compiles and changes no runtime behavior on stock configs.

## Fix

```diff
-	devfs_msg_send(DEVFS_TERMINATE_CORE, NULL);
+	msg = devfs_msg_get();
+	devfs_msg_send(DEVFS_TERMINATE_CORE, msg);
+	/* msg is auto-freed through the devfs_dispose_port reply */
```