{
  "finding_id": "DF-3061",
  "title": "NFS rename retry corrupts/leaks namecache state — remote kernel panic",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "cc -O2 -o /tmp/cl /tmp/cl.c && cc -O2 -o /tmp/rc4 /tmp/rc4.c (inside guest; sources inline in run.sh)",
    "run": "./run.sh (inside guest as root; sets up nfsd+mountd+loopback mount, starts 2 server-side racers + 6 client-side rename hammers)",
    "expected": "baseline: console 'nfs - retry rename src to dst' followed by 'Fatal trap 12 ... lockmgr_release+0x11' within ~1-3 minutes (2/2 runs); patched: no panic, system healthy"
  },
  "kernel_refs": [
    "sys/vfs/nfs/nfs_subs.c:1003",
    "sys/vfs/nfs/nfs_subs.c:1155",
    "sys/vfs/nfs/nfs_serv.c:2255",
    "sys/vfs/nfs/nfs_serv.c:2382",
    "sys/kern/vfs_nlookup.c:265",
    "sys/kern/vfs_nlookup.c:366",
    "sys/kern/vfs_cache.c:1154",
    "sys/sys/namecache.h:146"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "racer.c", "renamer.c", "run.sh", "build.sh",
    "fix.diff", "panic.txt", "panic_run2.txt", "panic_boot_full.log",
    "env.txt", "run.log", "manifest.json", "verdict.json"
  ],
  "note": "build.log/install.log were lost when an scp landed during a guest ssh-wedge window and the guest was subsequently reset; the build/install completion banners and the patched-kernel uname are recorded verbatim in run.log."
}