# DF-3514 — VERDICT

**Status: reproduced** (impact: panic). **Fix validated** (module-level).

Reproduced 4x on the guest, all `panic: hashdestroy: hash not empty`:
* 3x `ng_make_node_common()` path (ID-hash rehash at node creation),
* 1x `ng_name_node()` path (name-hash rehash — same bug class; first
  appeared after the ID-half fix, confirming both halves are live).

Root cause certain from source + traces: `#ifdef INVARIANTS`-gated
`LIST_REMOVE` in the rehash migration loops (ng_base.c:956-958, 988-990)
leaves every entry double-inserted on production/standalone-module builds;
`hashdestroy()` then trips. Additionally `ng_ID_rehash()` destroys the old
ID table with `ng_name_hmask` (ng_base.c:996) — wrong mask (OOB/under-run
walk).

Driver for crossing the rehash threshold in practice: permanent node-ref
inflation from DF-3513 (drained conq items pin el_dest) and DF-3515
(callout items pin their node) — both reproduced in the same session; also
plain repeated named-graph build/teardown.

Fix validated: unconditional LIST_REMOVE in both rehash functions +
`hashdestroy(ng_ID_hash, M_NETGRAPH_NODE, ng_ID_hmask)`. Guest module
rebuild; the previously-panicking workload (20 PoC cycles) then survived
20/20 with exit 0.

Classification: status=reproduced, reproduced=1, impact=panic,
confidence=certain, fix_status=fixed.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.