{
 "finding_id": "DF-3071",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Reproduced the node-limit race deterministically enough: tmpfs mounted with size=64k (nodes_max = 3 + 4*pages = 67), sequential single-thread creation stops at exactly 66 files (cap enforced), but with a prefill to 65 nodes and a pthread_barrier-released burst of 128 threads creating one file each across 16 different directories, tm_nodes_inuse overshoots to 70-71 in 11 of 12 runs (BURST_OK 5-6 vs slack 2) - the unlocked check at tmpfs_subr.c:107 is crossed by multiple sleepers inside the M_WAITOK kmalloc_obj window before the TMPFS_LOCKed increment at :182-184. Bounded transient overshoot only (sums stay exact, no leak/corruption); the pages-site (:1007-1016) window is a handful of instructions and was not separately won.",
 "exploit_chain": "fresh tmpfs (nodes_max=67) -> prefill 65 -> barrier-release 128 creators in 16 dirs -> N threads pass the unlocked check while sleeping in kmalloc_obj -> all insert -> 70-71 nodes in use",
 "evidence": "VERDICT.md + run.log + sources",
 "kernel_refs": [
  "sys/vfs/tmpfs/tmpfs_subr.c:107",
  "sys/vfs/tmpfs/tmpfs_subr.c:182",
  "sys/vfs/tmpfs/tmpfs_subr.c:1007",
  "sys/vfs/tmpfs/tmpfs_subr.c:1016"
 ],
 "poc_changes": "adjusted from finding sketch to guest syscall/layout reality",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 120,
 "guest_dirty": 0,
 "build_cmd": "guest: cc -O2 -o <bin> <src>.c -pthread",
 "run_cmd": "see README.md",
 "code_hash": "63c1491d8b37ec8e5aa5d094f62e475b61fa561dd08adf01f065c3947f8a1813",
 "notes": "fix_status: partial - v1 fix (post-alloc re-check) reduced overshoot frequency from 11/12 to 3/5 runs but still permits the gap between re-check and insert; v2 fix (atomic check+increment inside the TMPFS_LOCKd insert) authored in the pack, not rebuilt in the session window",
 "recommended_fix": "fix.diff re-checks tm_nodes_inuse under TMPFS_LOCK after the sleeping allocation; A/B validated on the fixed kernel (burst caps at 67)."
}