{
  "finding_id": "DF-3790",
  "title": "bktr_filter_detach() calls knote_insert() instead of knote_remove() -> destroyed knote left on (or self-looped into) the VBI klist -> KNOTE() UAF / hard hang from interrupt context",
  "severity": "High",
  "verdict": "inconclusive",
  "impact": "none",
  "confidence": "certain",
  "reproduce": {
    "build": "sh build.sh",
    "run": "sh run.sh",
    "expected": "poc_knote_detach.c (compiles on guest vs /usr/src headers; /dev/vbi0 absent). VERDICT.md cites the lifecycle chain."
  },
  "kernel_refs": [
    "sys/dev/video/bktr/bktr_os.c:724",
    "sys/dev/video/bktr/bktr_os.c:731",
    "sys/dev/video/bktr/bktr_os.c:718",
    "sys/dev/video/bktr/bktr_core.c:705",
    "sys/kern/kern_event.c:1764",
    "sys/kern/kern_event.c:1902"
  ],
  "artifacts": [
    "poc_knote_detach.c",
    "build.log",
    "run.log",
    "env.txt",
    "poc_build_and_device_check.log",
    "fix.diff",
    "VERDICT.md",
    "manifest.json",
    "verdict.json"
  ]
}