{
  "finding_id": "DF-3032",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "Code defect certain (IN_RENAME is cleared only on the xp==ip branch at ext2_vnops.c:1079; the xp!=ip lost-race success path strands the flag on the source directory until reclaim, making all future renames of it EINVAL at :755), exploitability speculative (requires winning a concurrent-rename race into the from-name slot between :781 and the relookup at :976). One-directory logic DoS, no memory-safety impact. Verification skipped by policy (Low/speculative).",
  "exploit_chain": "",
  "evidence": ["findings/poc/DF-3032/VERDICT.md — static path proof", "findings/poc/DF-3032/fix.diff"],
  "kernel_refs": ["sys/vfs/ext2fs/ext2_vnops.c:760", "sys/vfs/ext2fs/ext2_vnops.c:1025", "sys/vfs/ext2fs/ext2_vnops.c:1079", "sys/vfs/ext2fs/ext2_vnops.c:755"],
  "poc_changes": "n/a — no PoC seed; static-proof pack only",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Race window between step-2 direnter/dirrewrite and relookup at :976; IN_RENAME only blocks renames of ip itself (:755), not another rename targeting the same from-name slot.",
  "recommended_fix": "Clear IN_RENAME on ip in the xp != ip branch when doingdirectory (one-line flag clear before the final vputs)."
}