{
  "finding_id": "DF-3902",
  "title": "sioclose() gone-path double-free of com->ibuf (no NULL after kfree) + bzero of live struct tty",
  "verdict": "inconclusive",
  "impact": "heap corruption (panic/CE) on pccard hot-eject with >=2 open fds; physical-access class",
  "reproduce": {
    "build": "cc -o df3902_trigger df3902_trigger.c -Wall",
    "run": "pccard hw: ./df3902_trigger /dev/ttydN open; eject card; ENTER -> 2nd close double-frees. guest (non-gone): ./df3902_trigger /dev/ttyd0 -> clean RC=0 (logged)",
    "expected": "hardware: 'duplicate free' panic on 2nd close; guest: clean (gone cannot be set)"
  },
  "kernel_refs": ["sys/dev/serial/sio/sio.c:1475", "sys/dev/serial/sio/sio_pccard.c:135"],
  "artifacts": ["README.md", "VERDICT.md", "df3902_trigger.c", "sio_ioctl_test.c", "build.sh", "run.sh", "build.log", "run.log", "run_ioctl.log", "run_user_boundary.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"]
}