{
  "finding_id": "DF-3032",
  "verdict": "untested",
  "impact": "none",
  "summary": "ext2_rename sets IN_RENAME on the source directory inode (ext2_vnops.c:760) but clears it only in the xp==ip branch (:1079) and the bad:/out: unwinds (:1094,:1098); the successful xp!=ip lost-race path (:1025-1031) returns with the flag still set, permanently failing future renames of that directory with EINVAL (:755) until inode reclaim.",
  "evidence": ["findings/poc/DF-3032/VERDICT.md", "findings/poc/DF-3032/fix.diff", "sys/vfs/ext2fs/ext2_vnops.c:1025"],
  "reproduce": {
    "build": "n/a — speculative race; no deterministic trigger",
    "run": "n/a",
    "expected": "n/a"
  },
  "kernel_refs": ["sys/vfs/ext2fs/ext2_vnops.c:760", "sys/vfs/ext2fs/ext2_vnops.c:1025", "sys/vfs/ext2fs/ext2_vnops.c:1079", "sys/vfs/ufs/ufs_vnops.c:1199"],
  "artifacts": ["README.md", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json"],
  "notes": "Pass-2 race finding. ufs panics in the equivalent branch (ufs_vnops.c:1202); ext2 chose not to panic but leaked the flag. The adjacent inc_nlink(ip) at :781 is correctly accounted (step 2 created a real second link) — only the flag strands."
}