{
 "finding_id": "DF-3174",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "denial_of_service",
 "confidence": "certain",
 "verdict": "Logic defect certain by inspection: the request dedup loop matches on path+key without checking ar_done, so while any waiter still references a completed request every retry by another waiter re-acquires the corpse (refcount_acquire), observes ar_done immediately and returns the stale ar_error, burning one autofs_retry_attempts per 1-second parked iteration without ever handing a fresh request to automountd (which skips done requests). A faithful dynamic reproduction needs a configured automountd with a failing map plus concurrent waiters; the autofs module exists on the guest but the daemon harness exceeded this batch budget. Fix skips ar_done requests in the dedup scan; compile-validated.",
 "exploit_chain": "",
 "evidence": "VERDICT.md walk over autofs.c:324-339 (dedup), :366 (ar_done observed), :466-470 (ioctl skips done)",
 "kernel_refs": [
  "sys/vfs/autofs/autofs.c:324-339",
  "sys/vfs/autofs/autofs.c:366",
  "sys/vfs/autofs/autofs.c:466-470"
 ],
 "poc_changes": "",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "build_cmd": "n/a",
 "run_cmd": "n/a (needs configured automountd with a failing map)",
 "code_hash": "",
 "notes": "",
 "recommended_fix": "skip ar_done requests in the dedup loop"
}