{
  "finding_id": "DF-3181",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "NOT REPRODUCED from a stable userspace state in two attempts (open-fd holder with namecache entry; open+unlink holder with fd only): in both, dounmount() failed at its mnt_refs retry loop BEFORE VFS_UNMOUNT ran (the fds f_nchandle pins the mount), so tmpfs_unmounts destructive truncate-before-vflush order was never exercised and the file stayed 4194304 bytes. The code-order defect is unambiguous (tmpfs_vfsops.c:284-334 truncates every VREG node before vflush(mp,0,flags), and the author comment acknowledges the data loss on vflush failure), but reaching it requires a vnode busy without an f_nchandle (in-flight VOP race or transient kernel hold). Filed Low, speculative triggerability.",
  "exploit_chain": "",
  "evidence": [
    "run.log (attempt 1)",
    "run2.log (attempt 2: holder fstat polls stay 4194304 through t+16)",
    "VERDICT.md"
  ],
  "kernel_refs": [
    "sys/vfs/tmpfs/tmpfs_vfsops.c:284",
    "sys/vfs/tmpfs/tmpfs_vfsops.c:330"
  ],
  "poc_changes": "holder rewritten from shell to C (fstat polling on the open fd of the unlinked file); second attempt added unlink-before-umount to drop the namecache mount ref",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 120,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o holder holder.c",
  "run_cmd": "sh run.sh (root: mount tmpfs, 4MB file, holder open+unlink, umount)",
  "code_hash": "9596bd8f59d4bfc3f47b5357fd01d1cde425087f5b25e175f4aa21ca3b2047d6",
  "notes": "dounmount shield documented; destructive order still wrong whenever vflush fails after the truncate loop (forced-unmount teardown is expected-destructive and excluded)",
  "recommended_fix": "run vflush first and only truncate nodes after it succeeds (keep truncate-first only behind MNT_FORCE/FORCECLOSE)",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "",
  "fix_evidence": []
}