{
 "finding_id": "DF-3129",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "corruption",
 "confidence": "certain",
 "verdict": "Static proof is airtight: struct scaninfo.waitfor is never assigned anywhere in msdosfs_sync (only allerror and rescan are set) while msdosfs_sync_scan reads info->waitfor in the skip condition (RB_EMPTY(dirty) || (info->waitfor & MNT_LAZY)), so a forced sync skips denodes with pending metadata whenever the garbage bit matches MNT_LAZY. The effect is silent metadata-integrity loss with no runtime signature, and the uninit value never reaches userspace, so dynamic observation is not meaningful; the one-line fix is compile-validated in the combined build.",
 "exploit_chain": "",
 "evidence": "VERDICT.md walk over msdosfs_vfsops.c:740-839 showing the assignment provably absent (NetBSD sets ctx.waitfor, FreeBSD uses waitfor directly)",
 "kernel_refs": [
  "sys/vfs/msdosfs/msdosfs_vfsops.c:787-805",
  "sys/vfs/msdosfs/msdosfs_vfsops.c:839"
 ],
 "poc_changes": "",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "build_cmd": "n/a",
 "run_cmd": "n/a",
 "code_hash": "",
 "notes": "",
 "recommended_fix": "scaninfo.waitfor = waitfor"
}