{
 "finding_id": "DF-3008",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "likely",
 "verdict": "Attempted on the guest with a 20-second dual-thread hammer (805,155 kern.devname sysctl queries against 21,740,405 ptmx clone open/close cycles). The lifetime race IS crossed constantly - 397,088 queries returned ENOENT because the queried cdev had already been destroyed - but the post-destroy si_name read never returned stale or corrupted data: every successful lookup returned a well-formed device name (ptm/N) because the objcache retains freed chunk contents. The claimed UAF-read is therefore unobservable from userspace, exactly as the original finding predicted (reported for the lifetime-contract gap, not for a demonstrable disclosure).",
 "exploit_chain": "",
 "evidence": "VERDICT.md + run.log + sources",
 "kernel_refs": [
  "sys/vfs/devfs/devfs_core.c:1659",
  "sys/vfs/devfs/devfs_core.c:2771",
  "sys/vfs/devfs/devfs_core.c:2786"
 ],
 "poc_changes": "adjusted from finding sketch to guest syscall/layout reality",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 25,
 "guest_dirty": 0,
 "build_cmd": "guest: cc -O2 -o <bin> <src>.c -pthread",
 "run_cmd": "see README.md",
 "code_hash": "526efb40bd6d1fda013ff59b765a6deb9bf96d325a73bdcd00d76794895a97d3",
 "notes": "fix_status: not_testable (not reproduced)",
 "recommended_fix": "diff --git a/sys/vfs/devfs/devfs_core.c b/sys/vfs/devfs/devfs_core.c\nCopy si_name into the reply message in devfs_find_device_by_devid_worker so the sysctl never dereferences the cdev after the devfs lock is released.\n"
}