{
  "finding_id": "DF-3079",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Unprivileged local user permanently denies exclusive (O_EXCL) opens of /proc/<pid>/mem: procfs_open latches FWRITE into the shared pfs_flags on any write open (vnops.c:204-205) but procfs_close only clears the pair when O_EXCL was set (vnops.c:240-241), so a plain O_RDWR open+close leaves FWRITE latched and all later O_RDWR|O_EXCL opens return EBUSY (vnops.c:186-190) until the vnode is reclaimed. Reproduced 3/3 deterministic on the stock INVARIANTS guest as uid 1001; fresh-pid control open succeeds. No memory corruption; ceiling is a local DoS of a debugging facility.",
  "exploit_chain": "open(own /proc/self/mem, O_RDWR); close(fd); every subsequent open(/proc/<same pid>/mem, O_RDWR|O_EXCL) by any user returns EBUSY indefinitely (pfsnode persists while the vnode is cached).",
  "evidence": ["run.log and run.2.log: 'open(/proc/self/mem, O_RDWR|O_EXCL) = -1 Device busy' after plain write open+close, while 'open(/proc/child/mem, O_RDWR|O_EXCL) = 3 OK' control succeeds; BUG-REPRODUCED marker 3/3"],
  "kernel_refs": ["sys/vfs/procfs/procfs_vnops.c:186", "sys/vfs/procfs/procfs_vnops.c:204", "sys/vfs/procfs/procfs_vnops.c:240"],
  "poc_changes": "Written fresh for this finding; no seed existed.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 2,
  "guest_dirty": 0,
  "build_cmd": "cc -O -o /tmp/pse procfs_sticky_excl.c",
  "run_cmd": "/tmp/pse",
  "code_hash": "80c7d52382fb020cf914fd90f3e008e3630f77b07f004865d47e758f6129aa64",
  "notes": "EBUSY persists across processes; only vnode reclaim (memory pressure) clears it. pfs_flags is per-pfsnode shared state (procfs.h:71).",
  "recommended_fix": "In procfs_close Pmem case, clear FWRITE|O_EXCL on the last write close: condition on (a_fflag & FWRITE) && a_vp->v_opencount < 2 instead of requiring pfs_flags & O_EXCL.",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against read-only sys/ tree; kernel not rebuilt (non-memory-corruption Low finding, rebuild not mandated by contract).",
  "fix_evidence": ["fix.diff"]
}