# DF-3053 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Race-hammered against the real kernel nfsd (loopback TCP): a reader thread read() 4096 bytes into an anonymous mapping prefilled 0x5A while a second thread continuously flipped mprotect(PROT_NONE) on the region. Over 20,000 iterations: 115 reads returned FULL SUCCESS (ret=4096) while the destination buffer was still entirely 0x5A - the kernel delivered nothing yet reported complete delivery; 18,976 reads correctly returned EFAULT and 909 delivered. Data-integrity failure (silent short delivery reported as success) exactly as filed; no kernel-memory disclosure. The successful-stale hits confirm the ignored-copyout path is reachable from an unprivileged reader on any NFS mount.

## Kernel references
- sys/vfs/nfs/nfsm_subs.c:1074
- sys/vfs/nfs/nfsm_subs.c:1078

## Fix
See fix.diff.

## Fix validation (A/B on rebuilt kernel #0 Sun Oct 25 06:10:12 UTC 2026)
fix_status: not_testable - fix authored (copyout return checked, EFAULT propagated); A/B kernel cycle exhausted before the NFS rerun

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.