{
 "finding_id": "DF-3131",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "corruption",
 "confidence": "likely",
 "verdict": "The race landed 21 times out of 800 successful mounts: with the fspec string page munmapped inside the mountmsdosfs device-probe window, the copyinstr at msdosfs_vfsops.c:281 faults, its return is ignored, and the memset at :282 runs with stale stack size - observed live as statfs f_mntfromname coming back EMPTY (stale size 0 zeroed the whole field) on exactly those 21 mounts. That is the un-initialized-length write executing in-kernel; on this kernel build the stale slot held the benign value 0, so the out-of-bounds variant (stale size > MNAMELEN makes MNAMELEN - size wrap to a huge memset length) was not manifested, only its precondition. Requires mount privilege (root self-race, or vfs.usermount=1; note the stock DFly 6.5 caps layer denied the unprivileged mount attempt outright even with vfs.usermount=1, an additional reachability constraint recorded here).",
 "exploit_chain": "race2.c: thread A calls mount(2) with fspec pointing into a private page; thread B cycles munmap/mmap with a swept delay tuned into the device-probe window; after each successful mount statfs is checked for a garbled f_mntfromname (= faulted copyinstr + stale-size memset)",
 "evidence": "run.log: 21 GARBLED mntfromname lines with the winning delays (~2.1-2.4 ms), ok=800 garbled_name=21",
 "kernel_refs": [
  "sys/vfs/msdosfs/msdosfs_vfsops.c:281-282",
  "sys/vfs/msdosfs/msdosfs_vfsops.c:229-236"
 ],
 "poc_changes": "v1 (loop mount + free-running unmapper) never landed the window: 50000 attempts, 8712 successful mounts, 0 hits; v2 sweeps the munmap delay 0.3-4.3 ms around each mount and checks statfs, landing 21/800",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 180,
 "guest_dirty": 0,
 "build_cmd": "guest: cc -O -o race2 race2.c -lpthread",
 "run_cmd": "guest: race2 /dev/vn0 /mnt/raceroot 800",
 "code_hash": "4d450eb5774bc537fa240c2b5c7a333adf3ad022e25aaf97756132cac122827c",
 "notes": "stale stack slot held 0 on this build (benign empty-name memset); a hostile stale value >= MNAMELEN wraps the memset length; stock caps layer blocks unprivileged mounts even with vfs.usermount=1 on this snapshot",
 "recommended_fix": "check the copyinstr return before the memset; compile-validated"
}