{
  "finding_id": "DF-4482",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Reliable kernel panic (4/4 runs, identical bpdone: bp not busy backtrace through vinum launch_requests -> diskstrategy -> md inline biodone) when a mirrored vinum volume on md-backed drives is revived while concurrent writes straddle the moving revive cursor. Two UAF arms in the waitlist machinery are proven by inspection (drain relaunches then reads freed nodes at vinumrevive.c:216-217; append walks the concurrently-freed chain at vinumrequest.c:327-339); fixing both does not stop the panic, so at least one further lifetime defect in the relaunch path participates. Impact demonstrated as panic; the underlying primitive is a double-launch of freed/reused request memory (groomable M_DEVBUF zones), not driven to uid=0 because the trigger needs a root-started revive.",
  "exploit_chain": "root: mirrored concat volume on md drives + vinum start revive; unprivileged: concurrent conflicting writes (e.g. via filesystem mounted on the volume) -> XFR_REVIVECONFLICT waitlisting -> per-block drain launches requests that complete (and are freed by complete_rqe/freerq) synchronously inside launch -> freed chain walked/relaunched -> dev_dstrategy fires an already-completed buf -> panic. Controls (revive-only, writers-only, above-cursor-only, pinned-cursor-straddle-only) all clean.",
  "evidence": "panic.txt and run.2.log (baseline panics); run.3.patched.log + run.4.patched.log (panics persist through both fix attempts); VERDICT.md run matrix; setup_vinum.sh/writer.sh/race.sh/run.sh exact scripts",
  "kernel_refs": [
    "sys/dev/raid/vinum/vinumrevive.c:216",
    "sys/dev/raid/vinum/vinumrequest.c:327",
    "sys/dev/raid/vinum/vinumrequest.c:395",
    "sys/dev/raid/vinum/vinuminterrupt.c:211",
    "sys/dev/raid/vinum/vinuminterrupt.c:240",
    "sys/dev/raid/vinum/vinumstate.c:669",
    "sys/dev/disk/md/md.c:336"
  ],
  "poc_changes": "no seeded PoC existed; built from scratch: GPT vinum-typed partitions on auto-created md units (mdconfig absent on guest), mirrored concat volume via vinum create -f, stale+start to revive, 6 sweep-writer dd loops; -i 10000 used to pin the cursor for the control runs",
  "attempts": 9,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (6 CPUs)",
  "runtime_sec": 5400,
  "guest_dirty": 1,
  "build_cmd": "guest: cd /usr/src && git apply fix.diff && make -j8 nativekernel KERNCONF=X86_64_GENERIC && make installkernel KERNCONF=X86_64_GENERIC",
  "run_cmd": "sh setup_vinum.sh && sh run.sh",
  "code_hash": "36ec3b819bfab66d077557ca5b27c323f8cd530fcc568bdaa816290be61154ce",
  "notes": "guest left at db> panic prompt after final baseline confirmation; reset performed before return. Two kernel rebuilds (~25 min each) for fix attempts. See VERDICT.md for the full 9-run matrix and arm analysis.",
  "recommended_fix": "Redesign the revive-conflict relaunch: make freerq()/complete_rqe() detach requests from sd->waitlist, and never synchronously launch a waitlisted request whose inline completion frees it while the drain walker still references it (defer the relaunch or refcount the request across launch+drain); fix.diff in the pack fixes the two provable arms and is marked INSUFFICIENT",
  "fix_status": "fix_failed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 1,
  "fix_verdict": "Two minimal fixes attempted and kernel-rebuilt twice; the exact PoC still panics on both patched kernels (run.3.patched.log, run.4.patched.log), so the demonstrated bad behavior was NOT eliminated - the machinery needs a completion-aware lifetime redesign, not point fixes",
  "fix_evidence": "run.3.patched.log, run.4.patched.log (same bpdone: bp not busy panic on patched kernels); build/inst logs referenced in VERDICT.md"
}