# DF-3072 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Two attempts, both defeated by unrelated NFS-server instability before the target assert could fire. Attempt 1 (fstat-by-fh hammer at full speed against a 400MB tmpfs-backed exported file while root rm-ed it server-side): the guest panicked in the kernel NFS SERVER receive path instead - assertion "m->m_type == MT_DATA" failed in m_dup_data (uipc_mbuf.c:1806) via nfs_realign/nfsrv_rcv - an independent nfsd bug (panic captured in the pack). Attempt 2 (fstat throttled to ~3K/s): no panic; the guest WEDGED in namecache lock contention (cache_lock_shared diagnostics, nfs server not responding) requiring a hard reset. The tmpfs_alloc_vp DOOMED KKASSERT (tmpfs_subr.c:402) was never reached; the window requires an NFS-exported tmpfs which is itself an unusual configuration. Mechanism remains code-verified.

## Kernel references
- sys/vfs/tmpfs/tmpfs_subr.c:402
- sys/vfs/tmpfs/tmpfs_vnops.c:1799
- sys/vfs/tmpfs/tmpfs_vfsops.c:451

## Fix
See fix.diff.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.