# DF-3071 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Reproduced the node-limit race deterministically enough: tmpfs mounted with size=64k (nodes_max = 3 + 4*pages = 67), sequential single-thread creation stops at exactly 66 files (cap enforced), but with a prefill to 65 nodes and a pthread_barrier-released burst of 128 threads creating one file each across 16 different directories, tm_nodes_inuse overshoots to 70-71 in 11 of 12 runs (BURST_OK 5-6 vs slack 2) - the unlocked check at tmpfs_subr.c:107 is crossed by multiple sleepers inside the M_WAITOK kmalloc_obj window before the TMPFS_LOCKed increment at :182-184. Bounded transient overshoot only (sums stay exact, no leak/corruption); the pages-site (:1007-1016) window is a handful of instructions and was not separately won.

## Kernel references
- sys/vfs/tmpfs/tmpfs_subr.c:107
- sys/vfs/tmpfs/tmpfs_subr.c:182
- sys/vfs/tmpfs/tmpfs_subr.c:1007
- sys/vfs/tmpfs/tmpfs_subr.c:1016

## Fix
See fix.diff.

## Fix validation (A/B on rebuilt kernel #0 Sun Oct 25 06:10:12 UTC 2026)
fix_status: partial - v1 fix (post-alloc re-check) reduced overshoot frequency from 11/12 to 3/5 runs but still permits the gap between re-check and insert; v2 fix (atomic check+increment inside the TMPFS_LOCKd insert) authored in the pack, not rebuilt in the session window

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.