{
  "finding_id": "DF-3790",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "INCONCLUSIVE at runtime (needs the bktr device + VBI interrupts; absent on this guest). Source-certain: the inverted call is unambiguous and the knote lifecycle (kern_event.c:1764-1774, 2084-2097 knote_free cache) confirms the dangling entry and interrupt-context consumer.",
  "exploit_chain": "open /dev/vbi0 (0444) -> kqueue EVFILT_READ ADD on it -> EV_DELETE the note (f_detach re-inserts; knote freed + cached) -> keep /dev/vbi0 open, start PAL continuous capture -> even-field interrupt KNOTE() walks the dangling/self-looped entry -> UAF call or infinite loop with pool token held.",
  "evidence": "poc_knote_detach.c (compiles on guest vs /usr/src headers; /dev/vbi0 absent). VERDICT.md cites the lifecycle chain.",
  "kernel_refs": [
    "sys/dev/video/bktr/bktr_os.c:724",
    "sys/dev/video/bktr/bktr_os.c:731",
    "sys/dev/video/bktr/bktr_os.c:718",
    "sys/dev/video/bktr/bktr_core.c:705",
    "sys/kern/kern_event.c:1764",
    "sys/kern/kern_event.c:1902"
  ],
  "poc_changes": "none",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "cc -O -I/usr/src/sys -o poc poc_knote_detach.c",
  "run_cmd": "./poc",
  "code_hash": "73804c012a34a6f99ec1f9ffe620e2615c096553c1ef710e7feb8d3632371842",
  "notes": "Cross-file root cause (bktr_os.c), sink in bktr_core.c; suggest filing against both.",
  "recommended_fix": "knote_remove() in bktr_filter_detach (fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Runtime fix validation impossible on this guest (no Bt848/878 hardware, driver not in GENERIC, no module dir). fix.diff applies cleanly to sys/ and the patched bktr KLD module compiles with -Werror on the guests /usr/src (fix_build.log).",
  "fix_evidence": "fix.diff; fix_build.log (all-8-fixes module build, MAKE_RC=0)"
}