{
 "finding_id": "DF-3110",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "corruption",
 "confidence": "likely",
 "verdict": "Not dynamically reproducible: the defect requires a tracked cursor parked on the internal parent node (mirror-read EDEADLK recovery or reblock-style internal iteration, both root-triggered ioctls) racing a concurrent rebalance that moves element zero of a child node. Static confirmation is line-exact: in the again2 loop of hammer_cursor_moved_element the leaf fixup compares cursor->leaf against ondisk->elms[oindex].leaf after ondisk was reassigned to oparent->ondisk, while cursors in this loop sit at oparent index pindex (oindex is always 0 on this path, so any pindex != 0 fails to match and cursor->leaf keeps pointing into the dropped oparent element array). Fix swaps the comparison to pindex; compile-validated in the combined fixed-kernel build.",
 "exploit_chain": "",
 "evidence": "VERDICT.md source walk at hammer_cursor.c:1040-1077; fix.diff; kbuild.log (combined build compiles the fix)",
 "kernel_refs": [
  "sys/vfs/hammer/hammer_cursor.c:1054-1075"
 ],
 "poc_changes": "",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "build_cmd": "n/a (analysis + compile validation via combined fixed kernel)",
 "run_cmd": "n/a",
 "code_hash": "",
 "notes": "",
 "recommended_fix": "one-line: use pindex in the again2 leaf comparison"
}