{
 "finding_id": "DF-3242",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "leak",
 "confidence": "certain",
 "verdict": "UAF window certain by inspection but gated on the privileged free side: vfs_export_lookup returns the matched netcred after releasing NE_LOCK, ufs_check_export hands out &np->netc_anon, and nfsrv_fhtovp reads cr_uid/cr_ngroups/cr_groups only after VFS_FHTOVP (which may block on disk I/O) - during which vfs_export (mount -u -o -export) frees the netcred, so the squashed credential is read from freed memory (wrong uid/groups, pathologically uid 0, or a fault). A faithful reproduction needs a root actor toggling exports against live NFS traffic; the free side makes it a correctness hazard rather than an attack. Fix copies the anon cred out under the lock (crdup) with the matching crfree in nfsrv_fhtovp; compile-validated.",
 "exploit_chain": "",
 "evidence": "VERDICT.md walk over ufs_vfsops.c:246-251 and nfs_subs.c:1238/:1272-1275",
 "kernel_refs": [
  "sys/vfs/ufs/ufs_vfsops.c:246-251",
  "sys/vfs/nfs/nfs_subs.c:1272-1275"
 ],
 "poc_changes": "",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "build_cmd": "n/a",
 "run_cmd": "n/a (needs export churn racing NFS requests)",
 "code_hash": "",
 "notes": "",
 "recommended_fix": "crdup the anon credential; crfree it in nfsrv_fhtovp"
}