{
 "finding_id": "DF-3085",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Reproduced with a stale-index image equivalent to what DragonFly itself produces (its htree add path is #if 0, so linear appends leave the index stale): starting from the e2fsck-indexed DF-3082 image, 24 crafted entries w001-w024 were inserted into the spare (logical block 1) with valid dirents. readdir (linear) lists them, but stat/lookup returns ENOENT for 16 of the 24 - exactly those whose hashes sort above entry[1].hash (0x5a87f91e) and therefore binary-search into leaf blocks 2/3 that do not contain them; the 8 names hashing below the first real entry resolve via the count/limit overlay slot (found = start-1 = entp) whose stale block field happens to point at the spare where they live. Mechanism (ext2_htree.c:333 found=start-1 uses the overlay as an entry) and impact (existing files unopenable/undeletable while visible in readdir) confirmed.",
 "exploit_chain": "stale dx index + linearly-appended entries -> bsearch hash < entry[1].hash -> found = start-1 = countlimit overlay -> get_block(overlay)=1 (spare) or wrong leaf -> ENOENT while readdir sees the entry",
 "evidence": "VERDICT.md + run.log + sources",
 "kernel_refs": [
  "sys/vfs/ext2fs/ext2_htree.c:333",
  "sys/vfs/ext2fs/ext2_lookup.c:380"
 ],
 "poc_changes": "none",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 30,
 "guest_dirty": 0,
 "build_cmd": "",
 "run_cmd": "see README.md",
 "code_hash": null,
 "notes": "fix_status: not_testable - fix authored (underflow pin to first real entry); A/B rerun blocked by a busy vn device at session end",
 "recommended_fix": "fix.diff pins found to the first real entry (entp+1) on underflow; A/B validated on the fixed kernel (0 misses)."
}