{
 "finding_id": "DF-3414",
 "status": "reproduced",
 "reproduced": 1,
 "poc_path": "findings/poc/DF-3414",
 "artifact_dir": "findings/poc/DF-3414",
 "build_cmd": "cc -O -o <prog> <prog>.c  (on the guest)",
 "run_cmd": "60 (root)",
 "code_hash": "1b0351fbd7b7f42ae9f8f28375799954b69f2fac7a6e0aebcdce48a838de02e2",
 "build_log": "(inline)",
 "run_log": "VERDICT.md",
 "impact": "panic",
 "confidence": "certain",
 "verdict": "if_clone_destroy drops the ifnet lock between ifunit() lookup and teardown: two concurrent SIOCIFDESTROY destroyers both pass the lookup and double-run if_clone_free_unit + ifc->ifc_destroy. Reproduced TWICE on this guest with a dedicated destroyer-vs-destroyor race (no tun cdev involvement): panic if_clone_free_unit: bit is already cleared, trace if_clone_destroy <- ifioctl <- syscall2. On non-INVARIANTS kernels the same interleaving is a double bit-clear plus ifc->ifc_destroy on a freed ifnet (UAF).",
 "exploit_chain": "",
 "evidence": "panic.txt + panic.2.txt (two independent panics, full traces); race_clone.c",
 "kernel_refs": [
  "sys/net/if_clone.c:104-135",
  "sys/net/if_clone.c:if_clone_free_unit"
 ],
 "poc_changes": "",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "runner": "df-bsd-reviewer",
 "notes": "",
 "recommended_fix": "fix.diff",
 "fix_status": "fixed",
 "fix_verdict": "The lock-across-lookup fix was A/B-validated on this same guest by the DF-3407 pack (patched kernel #3 there: 2x120s of the identical destroy racing ran clean, panic gone). fix.diff carries the identical change; baseline here reproduced the panic twice independently (panic.txt, panic.2.txt).",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0
}