{
  "finding_id": "DF-3158",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "deget() sets de_refcnt=1 at msdosfs_denode.c:323, after msdosfs_hashins() (:308) has published the denode and released dehash_token; hashget (:131) and hashins (:178) both treat refcnt<=0 entries as absent, so a concurrent deget on another CPU could insert a duplicate denode for the same dirent. Empirically NOT reproduced: with an honest detector (ftruncate success required + persistent-divergence confirmation) 0 confirmed duplicates in ~2-4M synchronized deget pairs on 6 vCPUs, stock and patched kernels; an earlier naive detector produced thousands of false hits (transient divergences) which were root-caused to the detector, not the kernel. Reported as speculative hardening; the one-line ordering fix was built and boots clean.",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-3158/run.log -- naive vs hardened detector runs; hardened shows only [transient] divergences, 0 confirmed",
    "sys/vfs/msdosfs/msdosfs_denode.c:308-323 -- the insertion/refcnt window"
  ],
  "kernel_refs": [
    "sys/vfs/msdosfs/msdosfs_denode.c:308",
    "sys/vfs/msdosfs/msdosfs_denode.c:323",
    "sys/vfs/msdosfs/msdosfs_denode.c:127-160",
    "sys/vfs/msdosfs/msdosfs_denode.c:174-183"
  ],
  "poc_changes": "Detector hardened after the initial version produced false positives: truncator publishes rounds only on ftruncate()==0 and every candidate divergence is confirmed persistent by truncating via a second fd and re-statting (duplicates never converge).",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64 (stock) / #3 patched",
  "runtime_sec": 480,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -pthread -o /tmp/hammer hammer.c",
  "run_cmd": "/tmp/hammer /fat/RACEFILE 150",
  "code_hash": "",
  "notes": "Lesson recorded: the first detector generation (2180 hits) was an artifact of ignoring ftruncate failures and not confirming persistence -- always validate a positive before claiming a race. The window analysis stands; severity Medium downgraded from initial estimate because it did not manifest under saturated load.",
  "recommended_fix": "Set ldep->de_refcnt = 1 before msdosfs_hashins(ldep) in deget() (included in DF-3157 fix.diff; validated)"
}