⬢ DragonFlyBSD Kernel Audit
DF-3073 / run.fixed.log
← back to finding ↓ download raw
DF-3073 run.fixed.log — fix validation (patched kernel #1 Sat Sep 5 23:42:21 UTC 2026,
fix.diff applied to /usr/src/sys/vfs/nfs/nfs_vfsops.c, make nativekernel + installkernel)

uname: DragonFly dfbsd 6.5-DEVELOPMENT #1: Sat Sep  5 23:42:21 UTC 2026

Exact same PoC as the baseline run (same fakesrv2, same holder2, same mount):

  # mount_nfs -o tcp,port=2049 127.0.0.1:/P /mnt/nfsx && echo MOUNT_OK
  MOUNT_OK
  # su -m nobody -c '/tmp/holder2 /mnt/nfsx'
  DEV_OPEN_OK
  FD_PARKED
  # ps -o pid,stat,command -ax | grep holder2 | grep -v grep
   828 S4     /tmp/holder2 /mnt/nfsx
  # umount /mnt/nfsx
  umount: unmount of /mnt/nfsx failed: Device busy        (PLAIN_UMNT_RC=1)
  # date; umount -f /mnt/nfsx; echo UMNTF_RC=$?; date
  Sun Sep  6 00:06:50 UTC 2026
  umount: unmount of /mnt/nfsx failed: Device busy
  UMNTF_RC=1                                              <- EBUSY, NOT a panic
  Sun Sep  6 00:07:04 UTC 2026                            (~14 s retry loop)
  # mount | grep nfsx
  127.0.0.1:/P on /mnt/nfsx (nfs)                         <- mount intact
  GUEST_ALIVE_CHECK_OK

Serial console during the patched umount -f (fixed.console.txt):
  unmount(/mnt/nfsx): forced umount of "(null)" - 1 namecache refs, 1 mount refs
  unmount(/mnt/nfsx): (0xfffff8008dcd9000): 1 namecache refs, 1 mount refs still present
  unmount(/mnt/nfsx): forcing unmount
  vflush: Warning, cannot destroy busy device vnode
  unmount(/mnt/nfsx): (0xfffff8008dcd9000) unmount: vfs refused to unmount, error 16
  ^-- NFS now REFUSES (EBUSY); NO "NFS inodes ... still allocated",
      NO malloc_uninit, NO panic.

Recovery check (holder released):
  # pkill -9 holder2; sleep 2
  # umount -f /mnt/nfsx; echo UMNTF_RC=$?
  UMNTF_RC=0                                              <- clean unmount
  # mount | grep -c nfsx
  0

Summary:
  baseline (stock #0):   umount -f -> panic "unmount: dangling vnode" (panic.txt)
  patched  (#1):         umount -f -> EBUSY, machine alive, mount recoverable,
                         clean unmount once the holder releases.