# DF-3055 — evidence pack

**Finding:** dirfs_nsymlink/nmkdir run the success path when dirfs_alloc_file fails: dirfs_knote(NULL) SIGSEGV, negative-cache of an existing name, error clobbered by stale errno

**Verdict: REPRODUCED (deterministic two-TU harness; dirfs is vkernel-only). Impact: vkernel crash (racy create/remove trigger) + persistent namecache inconsistency + errno clobber (incl. fake success).**

## Reproduce
```
./build.sh   # cc -O2 -Wall -o harness harness.c knote.c
./run.sh     # expect BUG CONFIRMED + FIX VALIDATED; rc=2
```

See VERDICT.md for the full narrative; manifest.json / verdict.json for machine-readable results.