{
 "finding_id": "DF-3043",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "likely",
 "verdict": "Not demonstrated end-to-end. The malicious-claims route (oversized GETATTR size + client-side EFBIG readahead leak) required the custom NFSv3 server rig which, after extensive bring-up (record-mark, fattr XDR and fh-length bugs fixed), still could not complete a functional client mount against the stock kernel in available time; the forced-unmount abort site (d) of this same accounting bug was exercised heavily under DF-3052 (126 early aborts observed) but nm_bioqlen itself is not userland-visible and the mount dies with the aborts, so the mount-wide read-ahead-death observable was never measurable. Accounting sites remain code-certain: increment only at nfs_bio.c:957, decrement only in nfs_iod.c:139/212, bypasses at nfs_bio.c:1346-1373/:1463-1478/:1687-1693 and the commit-to-write reissue at :1753-1755.",
 "exploit_chain": "",
 "evidence": "VERDICT.md + run.log + sources",
 "kernel_refs": [
  "sys/vfs/nfs/nfs_bio.c:957",
  "sys/vfs/nfs/nfs_bio.c:1346",
  "sys/vfs/nfs/nfs_bio.c:1753",
  "sys/vfs/nfs/nfs_iod.c:139"
 ],
 "poc_changes": "adjusted from finding sketch to guest syscall/layout reality",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 300,
 "guest_dirty": 0,
 "build_cmd": "guest: cc -O2 -o <bin> <src>.c -pthread",
 "run_cmd": "see README.md",
 "code_hash": "50112fbce8d92828a1db010513e6b4bc96ff6b7d2f6d5613a8a75febbf9ea2d9",
 "notes": "fix_status: not_testable (not reproduced)",
 "recommended_fix": "diff: decrement nm_bioqlen at every biodone-without-request bypass site and re-increment on the commit-to-write reissue chain.\n"
}