{
 "finding_id": "DF-3206",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "denial_of_service",
 "confidence": "likely",
 "verdict": "32.2 million lstat(DIR/..) iterations against a crafted RRIP ISO (64 sibling entries in the raced directory) with two concurrent scanners produced zero misresolutions in 90 seconds. The defect is structurally real - dp->i_ino is shared scan scratch, cd9660_lookup unlocks the directory at :343 and only then evaluates dp->i_ino as the vget argument at :344-345 - but the window between the unlock return and the i_ino load is a few instructions, and a blocked scanner wakes from the vnode lock far too late (sleep-based handoff) to overwrite i_ino inside it on this guest. The crafted ISO and racer are retained; the fix (snapshot i_ino/reloc into locals before the unlock) is compile-validated.",
 "exploit_chain": "",
 "evidence": "run.log: root ino 65536, DIR ino 69632, a_iters=32228978 a_hits=0; racer.c, craft_dotdot_iso.py",
 "kernel_refs": [
  "sys/vfs/isofs/cd9660/cd9660_lookup.c:343-345",
  "sys/vfs/isofs/cd9660/cd9660_lookup.c:260-261"
 ],
 "poc_changes": "namecache serves .. after first resolution, so hit rate depends on cache churn (vfs.cache clean_neg_count 9M shows aggressive reclaim); 3 racing threads give 2 real scanners",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 120,
 "guest_dirty": 0,
 "build_cmd": "host: python3 craft_dotdot_iso.py out.iso; guest: cc -O -o racer racer.c -lpthread",
 "run_cmd": "guest: mount_cd9660 -o ro /dev/vn2 /mnt && su -m nobody -c /tmp/racer /mnt 90",
 "code_hash": "c638bd6c6f172624fdc90e5d6d25a08c60c749dc3bfe886bc52537ada0e8cef5",
 "notes": "",
 "recommended_fix": "snapshot dp->i_ino and the reloc flag into locals before vn_unlock"
}