# DF-3174 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

## Bottom line

Logic defect certain by inspection: the request dedup loop matches on path+key without checking ar_done, so while any waiter still references a completed request every retry by another waiter re-acquires the corpse (refcount_acquire), observes ar_done immediately and returns the stale ar_error, burning one autofs_retry_attempts per 1-second parked iteration without ever handing a fresh request to automountd (which skips done requests). A faithful dynamic reproduction needs a configured automountd with a failing map plus concurrent waiters; the autofs module exists on the guest but the daemon harness exceeded this batch budget. Fix skips ar_done requests in the dedup scan; compile-validated.

## Kernel references
- sys/vfs/autofs/autofs.c:324-339
- sys/vfs/autofs/autofs.c:366
- sys/vfs/autofs/autofs.c:466-470

## Exploit chain
(none: availability/correctness finding; no privilege chain)

## Fix

skip ar_done requests in the dedup loop

See fix.diff in this directory (git-apply-able against the read-only sys/
tree; applied only inside the disposable verification guest).

## Reproduction

build: n/a

run: n/a (needs configured automountd with a failing map)

expected: n/a

## Notes on the PoC (what changed vs the finding sketch)

(none)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.