{
  "finding_id": "DF-3251",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Structural finding only (Medium, DF-3208 cd9660 twin): ext2_vget publishes the inode via ext2_ihashins (ext2_vfsops.c:1313) before reading/validating the dinode, and all three post-publish error branches (bread :1358, ext2_ei2i EINVAL :1373 with deterministic crafted-image triggers, ext2_vinit VNON EINVAL :1406) hand a concurrent ext2_ihashget waiter a VBAD/VNON half- or fully-initialized vnode as a successful VFS_VGET result, bypassing ext2_vinits only unallocated inodes should be VNON validation. Not PoC-verified in this run (outside the mandatory verify buckets); single-threaded self-cleanup via VREF_FINALIZE synchronous reclaim was verified during DF-3250 work.",
  "exploit_chain": "",
  "evidence": [
    "README.md (path:line analysis)"
  ],
  "kernel_refs": [
    "sys/vfs/ext2fs/ext2_vfsops.c:1313",
    "sys/vfs/ext2fs/ext2_vfsops.c:1358",
    "sys/vfs/ext2fs/ext2_vfsops.c:1373",
    "sys/vfs/ext2fs/ext2_vfsops.c:1406",
    "sys/vfs/ext2fs/ext2_inode_cnv.c:109",
    "sys/vfs/ext2fs/ext2_ihash.c:100"
  ],
  "poc_changes": "",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Verification would need a crafted ext2 image whose target inode triggers ext2_ei2i EINVAL (bad e2di_extra_isize) or a typeless mode, plus a barriered pair racing the first lookup - harness reusable from findings/poc/DF-3250 (fh_race.c pattern).",
  "recommended_fix": "Hash the inode only after ext2_ei2i + ext2_vinit succeed (or remove it from the hash and set VBAD on every post-publish error branch before vx_put)."
}