{
 "finding_id": "DF-3072",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "likely",
 "verdict": "Two attempts, both defeated by unrelated NFS-server instability before the target assert could fire. Attempt 1 (fstat-by-fh hammer at full speed against a 400MB tmpfs-backed exported file while root rm-ed it server-side): the guest panicked in the kernel NFS SERVER receive path instead - assertion \"m->m_type == MT_DATA\" failed in m_dup_data (uipc_mbuf.c:1806) via nfs_realign/nfsrv_rcv - an independent nfsd bug (panic captured in the pack). Attempt 2 (fstat throttled to ~3K/s): no panic; the guest WEDGED in namecache lock contention (cache_lock_shared diagnostics, nfs server not responding) requiring a hard reset. The tmpfs_alloc_vp DOOMED KKASSERT (tmpfs_subr.c:402) was never reached; the window requires an NFS-exported tmpfs which is itself an unusual configuration. Mechanism remains code-verified.",
 "exploit_chain": "",
 "evidence": "VERDICT.md + run.log + sources",
 "kernel_refs": [
  "sys/vfs/tmpfs/tmpfs_subr.c:402",
  "sys/vfs/tmpfs/tmpfs_vnops.c:1799",
  "sys/vfs/tmpfs/tmpfs_vfsops.c:451"
 ],
 "poc_changes": "adjusted from finding sketch to guest syscall/layout reality",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 240,
 "guest_dirty": 0,
 "build_cmd": "guest: cc -O2 -o <bin> <src>.c -pthread",
 "run_cmd": "see README.md",
 "code_hash": "077f72af94f153443c17a6cf20b034dfdc2c0b94ae2ce6e81b7b04d66f64799e",
 "notes": "fix_status: not_testable (not reproduced)",
 "recommended_fix": "diff: tmpfs_fhtovp scan skips nodes with tn_vpstate DOOMED or tn_links==0 (return ESTALE), and tmpfs_alloc_vp handles doomed-but-unreclaimed vnodes with ENOENT instead of KKASSERT.\n"
}