{
 "finding_id": "DF-3079",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "dos",
 "confidence": "certain",
 "verdict": "Unprivileged local user permanently denies exclusive (O_EXCL) opens of /proc/<pid>/mem: procfs_open latches FWRITE into the shared pfs_flags on any write open (vnops.c:204-205) but procfs_close only clears the pair when O_EXCL was set (vnops.c:240-241), so a plain O_RDWR open+close leaves FWRITE latched and all later O_RDWR|O_EXCL opens return EBUSY (vnops.c:186-190) until the vnode is reclaimed. Reproduced 3/3 deterministic on the stock INVARIANTS guest as uid 1001; fresh-pid control open succeeds. No memory corruption; ceiling is a local DoS of a debugging facility.",
 "exploit_chain": "open(own /proc/self/mem, O_RDWR); close(fd); every subsequent open(/proc/<same pid>/mem, O_RDWR|O_EXCL) by any user returns EBUSY indefinitely (pfsnode persists while the vnode is cached).",
 "evidence": [
  "run.log and run.2.log: open(/proc/self/mem, O_RDWR|O_EXCL) = -1 Device busy after plain write open+close, while open(/proc/child/mem, O_RDWR|O_EXCL) = 3 OK control succeeds; BUG-REPRODUCED marker 3/3"
 ],
 "kernel_refs": [
  "sys/vfs/procfs/procfs_vnops.c:186",
  "sys/vfs/procfs/procfs_vnops.c:204",
  "sys/vfs/procfs/procfs_vnops.c:240"
 ],
 "poc_changes": "Written fresh for this finding; no seed existed.",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 2,
 "guest_dirty": 0,
 "build_cmd": "cc -O -o /tmp/pse procfs_sticky_excl.c",
 "run_cmd": "/tmp/pse",
 "code_hash": "80c7d52382fb020cf914fd90f3e008e3630f77b07f004865d47e758f6129aa64",
 "notes": "EBUSY persists across processes; only vnode reclaim (memory pressure) clears it. pfs_flags is per-pfsnode shared state (procfs.h:71).",
 "recommended_fix": "In procfs_close Pmem case, clear FWRITE|O_EXCL on the last write close: condition on (a_fflag & FWRITE) && a_vp->v_opencount < 2 instead of requiring pfs_flags & O_EXCL.",
 "fix_status": "not_testable",
 "fix_kernel_uname": "",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_verdict": "fix.diff authored against read-only sys/ tree; kernel not rebuilt (non-memory-corruption Low finding, rebuild not mandated by contract).",
 "fix_evidence": [
  "fix.diff"
 ]
}