# DF-3021 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Not exercised: triggering needs a device destroyed under an open fd (root-mediated revoke/driver detach), then fstat(fd) racing the detach. Line-verified: devfs_fo_stat calls vn_stat (guarded getattr) then unconditionally executes sb->st_rdev = devid_from_dev(DEVFS_NODE(vp)->d_dev) at devfs_vnops.c:1432, while devfs_vop_getattr carries an explicit node==NULL EIO guard at :565. Certain-by-inspection NULL-deref window; unreachable without a root-triggered destroy race on this rig.

## Kernel references
- sys/vfs/devfs/devfs_vnops.c:1432
- sys/vfs/devfs/devfs_vnops.c:565

## Fix
See fix.diff.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.