# DF-3025 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Setup to tn_links=32766 (LINK_MAX-1) succeeded, then two threads raced link() into two different directories across 200 + 600 rounds - first with a pthread barrier and a shared source path, then with distinct source hard-links (/L1 and /L993) to defeat namecache serialization. Every round came out complementary (errno pair 0/EMLINK or 31/0): exactly one link succeeded and the other got EMLINK, i.e. the tn_links check (tmpfs_vnops.c:1210) and the atomic_add in tmpfs_alloc_dirent (tmpfs_subr.c:320) never overlapped. The kernel-level serialization of both link() syscalls on the shared target vnode (vn_lock before VOP_NLINK) appears to make the window uncrossable from link(2) on this 6-vCPU guest; the source-level gap remains.

## Kernel references
- sys/vfs/tmpfs/tmpfs_vnops.c:1209
- sys/vfs/tmpfs/tmpfs_subr.c:320

## Fix
See fix.diff.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.