# DF-3041 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Not reproduced (race window is the few instructions between brelse at hammer_ondisk.c:251 and the two vol0_stat_bigblocks loads at :254/:257; forcing buffer recycling exactly there requires concurrent raw-device I/O on the same devvp during a mount, and even then only statfs accounting bytes change). Line-verified: bp released and NULLed at :251-252, then ondisk->vol0_stat_bigblocks read twice through the stale pointer captured at :183, added (x512) into f_blocks. Fix is a two-line move.

## Kernel references
- sys/vfs/hammer/hammer_ondisk.c:251
- sys/vfs/hammer/hammer_ondisk.c:254
- sys/vfs/hammer/hammer_ondisk.c:257

## Fix
See fix.diff.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.