# DF-3129 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

## Bottom line

Static proof is airtight: struct scaninfo.waitfor is never assigned anywhere in msdosfs_sync (only allerror and rescan are set) while msdosfs_sync_scan reads info->waitfor in the skip condition (RB_EMPTY(dirty) || (info->waitfor & MNT_LAZY)), so a forced sync skips denodes with pending metadata whenever the garbage bit matches MNT_LAZY. The effect is silent metadata-integrity loss with no runtime signature, and the uninit value never reaches userspace, so dynamic observation is not meaningful; the one-line fix is compile-validated in the combined build.

## Kernel references
- sys/vfs/msdosfs/msdosfs_vfsops.c:787-805
- sys/vfs/msdosfs/msdosfs_vfsops.c:839

## Exploit chain
(none: availability/correctness finding; no privilege chain)

## Fix

scaninfo.waitfor = waitfor

See fix.diff in this directory (git-apply-able against the read-only sys/
tree; applied only inside the disposable verification guest).

## Reproduction

build: n/a

run: n/a

expected: n/a

## Notes on the PoC (what changed vs the finding sketch)

(none)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.