# DF-3018 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Not exercised on the guest: the finding itself concludes no live unprivileged trigger exists today (direct VOP_READ/WRITE on device vnodes only reachable via ctty forwarding; pty destruction gated by the pti refcount protocol; console ttys static; root-mediated revoke/detach required). Line-verified on the audit tree: devfs_spec_read/write cache dev and node, vn_unlock(vp), dispatch dev_dread/dev_dwrite, then write vfs_timestamp(&node->atime/mtime) through the possibly-stale cached node pointer (devfs_vnops.c:1717-1755), unlike the guarded devfs_fo_* fileops. Defense-in-depth gap, not a demonstrable bug on this rig.

## Kernel references
- sys/vfs/devfs/devfs_vnops.c:1708
- sys/vfs/devfs/devfs_vnops.c:1717
- sys/vfs/devfs/devfs_vnops.c:1752

## Fix
See fix.diff.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.