# DF-3008 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Attempted on the guest with a 20-second dual-thread hammer (805,155 kern.devname sysctl queries against 21,740,405 ptmx clone open/close cycles). The lifetime race IS crossed constantly - 397,088 queries returned ENOENT because the queried cdev had already been destroyed - but the post-destroy si_name read never returned stale or corrupted data: every successful lookup returned a well-formed device name (ptm/N) because the objcache retains freed chunk contents. The claimed UAF-read is therefore unobservable from userspace, exactly as the original finding predicted (reported for the lifetime-contract gap, not for a demonstrable disclosure).

## Kernel references
- sys/vfs/devfs/devfs_core.c:1659
- sys/vfs/devfs/devfs_core.c:2771
- sys/vfs/devfs/devfs_core.c:2786

## Fix
See fix.diff.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.