{
 "finding_id": "DF-3018",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "likely",
 "verdict": "Not exercised on the guest: the finding itself concludes no live unprivileged trigger exists today (direct VOP_READ/WRITE on device vnodes only reachable via ctty forwarding; pty destruction gated by the pti refcount protocol; console ttys static; root-mediated revoke/detach required). Line-verified on the audit tree: devfs_spec_read/write cache dev and node, vn_unlock(vp), dispatch dev_dread/dev_dwrite, then write vfs_timestamp(&node->atime/mtime) through the possibly-stale cached node pointer (devfs_vnops.c:1717-1755), unlike the guarded devfs_fo_* fileops. Defense-in-depth gap, not a demonstrable bug on this rig.",
 "exploit_chain": "",
 "evidence": "VERDICT.md + run.log + sources",
 "kernel_refs": [
  "sys/vfs/devfs/devfs_vnops.c:1708",
  "sys/vfs/devfs/devfs_vnops.c:1717",
  "sys/vfs/devfs/devfs_vnops.c:1752"
 ],
 "poc_changes": "none",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 0,
 "guest_dirty": 0,
 "build_cmd": "",
 "run_cmd": "see README.md",
 "code_hash": null,
 "notes": "fix_status: not_testable (not reproduced)",
 "recommended_fix": "diff: take reference_dev/release_dev around the dev_d* dispatch in devfs_spec_read/write/ioctl/kqfilter, mirroring devfs_fo_read/write (:1275/:1333).\n"
}