{
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "cd /root/df3169 && make KERNCONF=X86_64_GENERIC   (in-guest; needs /usr/src) + cc -O2 -pthread -o fake_daemon fake_daemon.c",
    "run": "/bin/sh /root/df3169/run.sh   (root; mounts autofs at /df3169_mp, starts stat churn, kldloads df3169_race.ko)",
    "expected": "UNPATCHED: 'DF3169: DANGLING REQUEST ... ar_mount=<freed amp>' + ar_from=\"AAAA...\" + several 'POLL ... <== WRITE-AFTER-FREE' lines + 'UAF CONFIRMED'. PATCHED (fix.diff): 'CLEAN - no post-free access', dangling=0, write_after_free_transitions=0, dounmount waits ~30s for the drain."
  },
  "kernel_refs": [
    "sys/vfs/autofs/autofs_vnops.c:191-242",
    "sys/vfs/autofs/autofs_vnops.c:245-278",
    "sys/vfs/autofs/autofs_vnops.c:297-325",
    "sys/vfs/autofs/autofs.c:427-455",
    "sys/vfs/autofs/autofs.c:312-356",
    "sys/vfs/autofs/autofs.c:409-413",
    "sys/vfs/autofs/autofs_vfsops.c:195-261"
  ],
  "artifacts": [
    "df3169_race.c", "Makefile", "fake_daemon.c", "run.sh", "variantB.sh", "sanity.sh",
    "build.log", "run.log", "run_kthread.log", "run_variantB.log", "fix_run.log",
    "fix_variantB.log", "fix_build.log", "fix.diff", "FIX_NOTES.md",
    "panic.txt", "panic_prelude.txt", "env.txt",
    "README.md", "VERDICT.md", "manifest.json", "verdict.json"
  ],
  "fix": {
    "fix_status": "fixed",
    "fix_diff": "fix.diff",
    "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Sep  7 15:11:46 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (stock + fix.diff v2 only)",
    "fix_notes": "v1 (vfs_busy wrap) deadlocked and was rejected; v2 (am_dying/am_triggers per-mount references + bounded EBUSY abort in autofs_unmount) validated: baseline UAF markers gone, harness and 6-cycle production-shaped stress clean, normal autofs behavior preserved."
  }
}