# DF-4280 — ccd(4) CCDIOCCLR busy-guard can never be satisfied (unit permanently stuck)

## Build
```
cc -O -o /tmp/df4280 /root/df4280/trigger.c     # on the guest, as root
```

## Run (guest, root; ccd module + a CCD-labelled component required)
```
kldload ccd
vnconfig -c -s labels vn0 /root/comp0.img       # 8MB file-backed vnode disk
disklabel32 -R -r vn0 labelfile                  # with partition 'd: fstype ccd'
/tmp/df4280 /dev/ccd0 /dev/vn0s0d                # SET then same-fd CLR
ccdconfig -u ccd0                                # stock tool — also EBUSY
kldunload ccd                                    # "In use, cannot detach"
```

## Expected (vulnerable kernel)
```
[+] CCDIOCSET ok size=16352
[-] CCDIOCCLR(same fd, no other users): Device busy
[-] BUG: unit can never be unconfigured this boot
ccdconfig: ioctl (CCDIOCCLR): /dev/ccd0: Device busy
ccd0: In use, cannot detach
```
## Expected (patched kernel — fix.diff hunk 2: disk_getopencount guard)
```
[+] CCDIOCSET ok size=16352
[+] CCDIOCCLR ok
```

## Root cause
- `ccdattach` stores `cs->sc_dev = disk_create(...)` — the RAW device
  (`_disk_create_named` returns `dp->d_rawdev`, subr_disk.c:763).
- `make_only_dev()` ends with `reference_dev(devfs_dev)` (kern_conf.c:294)
  — a permanent creator reference (destroy_only_dev releases TWICE,
  kern_conf.c:316-320, confirming the +1 convention).
- Therefore `dev_drefs(cs->sc_dev) >= 2` at all times; the guard
  `dev_drefs(cs->sc_dev) > 1` (ccd.c:1434) is unconditionally true.

## Impact
Once configured, a ccd unit is stuck for the boot: components are held
exclusively (cannot be reused/relabelled via other ccds), sc_cinfo /
sc_itable stay allocated, CCDF_INITED blocks reconfiguration, and the
ccd module can never be unloaded.  Triggering requires write access to
/dev/ccdN (root, or the operator group — nodes are 0640 root:operator).