{
 "finding_id": "DF-4407",
 "status": "untested",
 "attempts": 0,
 "reproduced": 0,
 "confidence": "likely",
 "impact": "dos",
 "verdict": "Source-verified missing SMP serialization of /dev/tpm: tpmopen (tpm.c:1146-1161) check-then-sets sc_flags|=TPM_OPEN with no lock (TOCTOU lets N CPUs all win the exclusive open), and tpmread/tpmwrite (tpm.c:1193-1252, 1267-1292) rely on crit_enter(), which in DragonFly only masks interrupts/preemption on the CURRENT CPU and provides no inter-CPU mutual exclusion, so concurrent transactions interleave TPM_DATA FIFO writes (tpm.c:821-843), locality handoff (tpm.c:412-427, 891-892) and shared sc->sc_stat. FreeBSD import tag is r365144 (tpm.c:18) - the exact commit that added dev_lock upstream - but the lock is absent here. Untested at runtime: the audit guest has no TPM device/module (env.txt) and both racers must already be root (make_dev 0600 root:wheel, tpm.c:253-254), so impact ceiling is privileged-only TPM wedge/DoS, not memory corruption.",
 "exploit_chain": "",
 "evidence": "findings/poc/DF-4407/VERDICT.md (full path:line trace), README.md (would-be PoC on hardware), env.txt (live guest proof: no /dev/tpm, no tpm module), fix.diff",
 "kernel_refs": [
  "sys/dev/crypto/tpm/tpm.c:1146",
  "sys/dev/crypto/tpm/tpm.c:1155",
  "sys/dev/crypto/tpm/tpm.c:1193",
  "sys/dev/crypto/tpm/tpm.c:1267",
  "sys/dev/crypto/tpm/tpm.c:821",
  "sys/dev/crypto/tpm/tpm.c:253"
 ],
 "poc_changes": "",
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 20,
 "guest_dirty": 0,
 "build_cmd": "",
 "run_cmd": "",
 "code_hash": "1f2dd36866d2d1178f913f7e1d76590f4e518946db81b8c9290e54bdb998143f",
 "notes": "Verification skipped per audit bar (Low severity, root-gated via 0600, no TPM hardware on guest - proven live in env.txt). Killed candidates recorded in pass-2 negative notes: negative TPM response length rejected because uio_resid is size_t (sys/_uio.h:69) sign-extends negative int len to huge; legacy paths dead (tpm_enabled never set in-tree); tsleep-under-crit_enter is legal DFly idiom (kern_synch.c tstop does the same).",
 "recommended_fix": "Add a lockmgr lock to struct tpm_softc, take it LK_EXCLUSIVE across tpmopen/tpmclose/tpmread/tpmwrite (mirror FreeBSD r365144); see fix.diff.",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "fix.diff authored from source analysis (lockmgr serialization); not buildable/validatable on the audit guest - no TPM device, driver not compiled into X86_64_GENERIC (optional tpm).",
 "fix_evidence": "findings/poc/DF-4407/fix.diff; env.txt"
}