# DF-3193 — VERDICT

**status: not_reproduced (panic) / trigger chain + use-after-free access proven by construction / impact observed: none (benign recycle)**

## What was run (baseline, stock INVARIANTS kernel #0)

Two runs of `./uaf` (6 cycles with zeroed-fmp spray; 5 cycles without
spray). Decisive single-cycle timeline (run.log + serial_full.txt):

1. `[888] daemon: WITHHOLDING reply for FUSE_STATFS unique=3` — worker
   (pid 890) now sleeps in `fuse_ipc_tx()` on its fip.
2. `[887] umount -f /mnt/dfc ... umount OK` — forced umount completes in
   ~1 s *while the worker sleeps* (dounmount forcing path,
   vfs_syscalls.c:975-993; fuse_unmount never aborts/drains in-flight
   IPCs).
3. `[888] daemon: FUSE_DESTROY -> reply, exit, close(fd)` — fd close →
   `fuse_cdevpriv_dtor` → `fuse_mount_free` drops the final ref →
   **fmp kfree'd** (~1.5 s into the cycle).
4. ~35 s later: serial console `fuse_ipc_wait(uaf|891): timeout` /
   `(uaf|892): timeout` — the workers take the full 6×5 s retry path;
   at its end `fuse_ipc_remove()` executed `mtx_lock(&fmp->ipc_lock)`
   and walked `fmp->request_head`/`reply_head` **on the fmp freed in
   step 3** (fuse_ipc.c:125-140). Workers return errno 16
   ("returned through freed-fmp path" in run.log).

The trigger schedule (hung-daemon statfs vs forced umount vs daemon
exit) is deterministic and reproduced in both runs; the freed-memory
lock/walk follows necessarily from the executed path (the "timeout"
print sits immediately before `fuse_ipc_remove` in fuse_ipc.c:185-187).

## Why no crash

The freed ~256-byte M_TEMP block was recycled with benign content
(zeroed fresh fmp objects from the spray run; empty stale heads in the
no-spray run), so the stale `mtx_lock` succeeded and the
`TAILQ_FOREACH` compared against NULL heads and exited. Turning the
walk into a spin/lock-corruption/page-fault requires non-zero garbage at
the `ipc_lock`/list offsets — a matter of what recycles the block in the
30 s window; INVARIANTS mtx owner checks make garbage at the lock word
likely to fire, but this was not observed within the time-boxed runs.
Honest classification per the contract: expected marker (panic) absent,
run exits, guest stays up ⇒ **not_reproduced**, reproduced=0,
impact=none. The lifetime defect itself is statically certain.

## Fix validation (behavioral)

Same patched fuse.ko as DF-3191/DF-3192 (drain in fuse_unmount +
post-enqueue dead recheck + remove-on-dead-entry):

- baseline cycle: umount returns ~1 s while the worker still sleeps
  (free happens under the in-flight IPC).
- patched cycle (fix_run.log): cycle wall time 83 s vs ~40 s — umount
  now blocks in the drain until the worker's ETIMEDOUT dequeues its fip;
  the worker's timeout path therefore runs on a **live** fmp
  (serial_full.txt in DF-3191's run for the patched boot shows
  `fuse_ipc_wait(uaf|926): timeout` executing after umount returned,
  i.e. on the still-referenced object), and the free happens only after
  both the drain and the unmount complete.
- no panic either way (the baseline crash is probabilistic), so the fix
  status is honestly **inconclusive** — the serialization the fix adds
  is demonstrated, the absence of a probabilistic crash is not provable
  in feasible time.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.