== fix validation: kernel rebuilt in-guest with fix.diff applied ==

$ cd /usr/src && patch -p1 < /root/fix.diff
Patching file sys/vfs/nfs/nfs_vfsops.c using Plan A...  Hunk #1 succeeded.
Patching file sys/vfs/nfs/nfs_kerb.c using Plan A...  Hunk #1 succeeded at 122.
PATCH-APPLIED

$ cd /usr/src && make -j6 nativekernel        (log: /root/build.log)
>>> Kernel build for X86_64_GENERIC completed on Wed Sep 9 16:37:34 UTC 2026
BUILD_RC=0            (grep -c "error:" build.log -> 0)
$ make installkernel
>>> Kernel install for X86_64_GENERIC completed on Wed Sep 9 16:39:55 UTC 2026
INSTALL_RC=0
$ reboot
$ uname -v
DragonFly 6.5-DEVELOPMENT #1: Wed Sep 9 16:33:56 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC

== re-run of the EXACT PoC on the fixed kernel ==
$ sh setup.sh; mount | grep nfspoc
127.0.0.1:/tmp on /mnt/nfspoc (nfs)
$ sh run.sh                                  # variant "sig", use_weird_array=1
+ ./poc /mnt/nfspoc sig
child 865: entering nfssvc(NFSSVC_MNTD, /mnt/nfspoc)
parent: SIGTERM -> child
parent: done
RUN1_RC=0
  -> NO panic; child exited cleanly (clientd: EINTR -> dounmount -> DISMNT
     delegated free -> single nfs_free_mount -> return). Guest up.

$ mount -o tcp 127.0.0.1:/tmp /mnt/nfspoc && sysctl debug.use_weird_array=1 \
  && ./poc /mnt/nfspoc umount                # variant "umount"
child 885: entering nfssvc(NFSSVC_MNTD, /mnt/nfspoc)
parent: unmount(/mnt/nfspoc)
child: nfssvc returned 0 errno=0 (UAF loop escaped)
parent: done
RUN2_RC=0
  -> NO panic; the clientd observed NFSSTA_DISMNT (now set by unmount as its
     LAST nmp action + wakeup), exited the loop, freed nmp exactly once,
     returned 0. Guest up, dmesg clean.

$ uptime ; dmesg | tail -3
 4:42PM  up 2 mins, 0 users, load averages: 0.06, 0.03.01
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
swap low/high-water marks set to 41940/62910
GUEST-STILL-UP

Baseline vs patched:
  baseline #0 : sig -> panic (double free)  | umount -> panic (double free)
  patched  #1 : sig -> clean exit           | umount -> clean exit, guest up
FIX VALIDATED.