# DF-3110 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

## Bottom line

Not dynamically reproducible: the defect requires a tracked cursor parked on the internal parent node (mirror-read EDEADLK recovery or reblock-style internal iteration, both root-triggered ioctls) racing a concurrent rebalance that moves element zero of a child node. Static confirmation is line-exact: in the again2 loop of hammer_cursor_moved_element the leaf fixup compares cursor->leaf against ondisk->elms[oindex].leaf after ondisk was reassigned to oparent->ondisk, while cursors in this loop sit at oparent index pindex (oindex is always 0 on this path, so any pindex != 0 fails to match and cursor->leaf keeps pointing into the dropped oparent element array). Fix swaps the comparison to pindex; compile-validated in the combined fixed-kernel build.

## Kernel references
- sys/vfs/hammer/hammer_cursor.c:1054-1075

## Exploit chain
(none: availability/correctness finding; no privilege chain)

## Fix

one-line: use pindex in the again2 leaf comparison

See fix.diff in this directory (git-apply-able against the read-only sys/
tree; applied only inside the disposable verification guest).

## Reproduction

build: n/a (analysis + compile validation via combined fixed kernel)

run: n/a

expected: n/a

## Notes on the PoC (what changed vs the finding sketch)

(none)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.