{
  "finding_id": "DF-3250",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "host: sh build.sh (mkfs.ext2 image + scp + guest module build + mount + 6000 hardlink pairs + kern.maxvnodes=1200); guest: see build.sh",
    "run": "guest as root: sh run.sh (two supervise.sh instances, each respawning the pinned fh_race pair; barrier stall-detection covers the kernel-side lost-wakeup wedge)",
    "expected": "baseline (instrumented stock module): within ~30-120s console prints 'DF3250[ihash]: EBUSY! ...' followed by 'panic: memory chunk ... is already free!' with stack _kfree <- ext2_alloc_vnode <- ext2_vget <- ext2_fhtovp. Fixed module (fix.diff): same EBUSY message, NO panic, guest alive, sysctl counters keep climbing (df3250_ebusy>=1)."
  },
  "kernel_refs": [
    "sys/vfs/ext2fs/ext2_vfsops.c:1297",
    "sys/vfs/ext2fs/ext2_vfsops.c:1313",
    "sys/vfs/ext2fs/ext2_vfsops.c:1319",
    "sys/vfs/ext2fs/ext2_inode.c:569",
    "sys/vfs/ext2fs/inode.h:174",
    "sys/kern/vfs_lock.c:763",
    "sys/vfs/ufs/ffs_vfsops.c:1120"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "fh_race.c", "race_e2.c", "reload.c",
    "instrument.diff", "fix.diff", "build.sh", "run.sh",
    "panic.txt", "fix_counters.txt", "fix_dmesg.txt",
    "verdict.json", "manifest.json"
  ]
}